= Whonix-Gateway =
== anon-gw-anonymizer-config ==

* https://github.com/Whonix/anon-gw-anonymizer-config
* [https://github.com/Whonix/anon-gw-anonymizer-config/blob/master/debian/control debian/control]
===  Tor Configuration and Tweaks for Anonymity Distributions ===

Tor config file with distribution defaults (for stream isolation, etc.),
example user configurations and other tweaks required. The Tor binary
itself does not get modified.

Deactivates IPv4 forwarding using /etc/sysctl.d/
IPv4 forwarding is not required for a Tor based Anonymity Distribution
Gateways. Deactivating it as defense in depth to prevent leaks.

Deactivates IPv6 using /etc/sysctl.d/
There are no IPv6 Anonymity Distribution Gateways featuring an IPv6 firewall
yet. Therefore deactivating it to prevent leaks.

This package is produced independently of, and carries no guarantee from,
The Tor Project.
=== /etc/torrc.d/60_network.conf ===

* [https://github.com/Whonix/anon-gw-anonymizer-config/blob/master/etc/torrc.d/60_network.conf /etc/torrc.d/60_network.conf]
* <code>~/derivative-maker/packages/anon-gw-anonymizer-config/etc/torrc.d/60_network.conf</code>
* gateway only<!--gateway-only-->

Tor is disabled by default.
Users are supposed to enable Tor through setup-dist which would
create file /usr/local/etc/torrc.d/40_tor_control_panel.conf with
"DisableNetwork 0" or by removing the hash ('#') in front of
"DisableNetwork 0" in /usr/local/etc/torrc.d/40_tor_control_panel.conf
* <code>DisableNetwork 1</code>

* <code>VirtualAddrNetwork 10.192.0.0/10</code>
* <code>AutomapHostsOnResolve 1</code>

* <code>Log notice file /run/tor/log</code>
=== /etc/torrc.d/65_gateway.conf ===

* [https://github.com/Whonix/anon-gw-anonymizer-config/blob/master/etc/torrc.d/65_gateway.conf /etc/torrc.d/65_gateway.conf]
* <code>~/derivative-maker/packages/anon-gw-anonymizer-config/etc/torrc.d/65_gateway.conf</code>
* gateway only<!--gateway-only-->

Tor settings for Gateway: `ClientOnionAuthDir`, `SocksPort`s, `TransPort`,
`DnsPort`, `HTTPTunnelPort`s and stream isolation settings.
=== /usr/share/tor/tor-service-defaults-torrc.anondist ===

* [https://github.com/Whonix/anon-gw-anonymizer-config/blob/master/usr/share/tor/tor-service-defaults-torrc.anondist /usr/share/tor/tor-service-defaults-torrc.anondist]
* <code>~/derivative-maker/packages/anon-gw-anonymizer-config/usr/share/tor/tor-service-defaults-torrc.anondist</code>
* gateway only<!--gateway-only-->

Tor settings for Workstation: `SocksPort`s, `TransPort`,
`DnsPort`, `HTTPTunnelPort`s and stream isolation settings.
IP HARDCODED unfortunately.
== whonix-gw-network-conf ==

* https://github.com/Whonix/whonix-gw-network-conf
* [https://github.com/Whonix/whonix-gw-network-conf/blob/master/debian/control debian/control]
===  Network Configuration for Whonix-Gateway ===

Includes etc/network/interfaces.d/30_non-qubes-whonix for
Non-Qubes-Whonix-Gateway.

Sets up two network interfaces, an external one eth0 and an internal one eth1.

Provides /usr/share/whonix-gw-network-conf/network_internal_ip.txt.

DNS configuration Anonymity Linux Distribution Gateways

* Pointing /etc/resolv.conf to 127.0.0.1.
* Whether a Anonymity Linux Distribution Gateway supports system DNS for its
own traffic in the clear or anonymized mainly depends on the Gateway's
firewall.
* Routing the workstation's system DNS through the anonymizer (also known as
Transparent DNS Proxy) or not is up to the Gateway's firewall as well.
=== /debian/whonix-gw-network-conf.links ===

* [https://github.com/Whonix/whonix-gw-network-conf/blob/master/debian/whonix-gw-network-conf.links /debian/whonix-gw-network-conf.links]
* <code>~/derivative-maker/packages/whonix-gw-network-conf/debian/whonix-gw-network-conf.links</code>
* gateway only<!--gateway-only-->
* Non-Qubes-Whonix only


Disable Predictable Network Interface Names as these are problematic.
https://forums.whonix.org/t/whonix-14-0-0-0-7-developers-only/3449/4
Disabling them as per
'zless /usr/share/doc/udev/README.Debian.gz'.
* <code>/dev/null /etc/systemd/network/99-default.link</code>

=== /debian/whonix-gw-network-conf.triggers ===

* [https://github.com/Whonix/whonix-gw-network-conf/blob/master/debian/whonix-gw-network-conf.triggers /debian/whonix-gw-network-conf.triggers]
* <code>~/derivative-maker/packages/whonix-gw-network-conf/debian/whonix-gw-network-conf.triggers</code>
* gateway only<!--gateway-only-->
* Non-Qubes-Whonix only


Required for /etc/systemd/network/99-default.link to take effect as per
'zless /usr/share/doc/udev/README.Debian.gz'.
* <code>activate-noawait update-initramfs</code>

=== /etc/network/interfaces.d/30_non-qubes-whonix ===

* [https://github.com/Whonix/whonix-gw-network-conf/blob/master/etc/network/interfaces.d/30_non-qubes-whonix /etc/network/interfaces.d/30_non-qubes-whonix]
* <code>~/derivative-maker/packages/whonix-gw-network-conf/etc/network/interfaces.d/30_non-qubes-whonix</code>
* gateway only<!--gateway-only-->
* Non-Qubes-Whonix only

network interfaces configuration eth0 (external network interface) and eth1 (internal network interface)

static network configuration

IP HARDCODED below but comment only. No need to change.
eth0
<code>#address 10.0.2.15</code><br />
<code>#netmask 255.255.255.0</code><br />
<code>#gateway 10.0.2.2</code><br />

eth1
<code>#address 10.152.152.10</code><br />
<code>#netmask 255.255.192.0</code><br />
=== /etc/resolv.conf.whonix ===

* [https://github.com/Whonix/whonix-gw-network-conf/blob/master/etc/resolv.conf.whonix /etc/resolv.conf.whonix]
* <code>~/derivative-maker/packages/whonix-gw-network-conf/etc/resolv.conf.whonix</code>
* gateway only<!--gateway-only-->

No DNS configuration.
Only comments.
Whonix-Gateway by default does not have system default DNS.
See https://www.whonix.org/wiki/Whonix-Gateway_Own_Traffic_Transparent_Proxy
and footnotes.
=== /lib/systemd/system/onion-grater.service.d/30_cpfpy.conf ===

* [https://github.com/Whonix/whonix-gw-network-conf/blob/master/usr/lib/systemd/system/onion-grater.service.d/30_cpfpy.conf /lib/systemd/system/onion-grater.service.d/30_cpfpy.conf]
* <code>~/derivative-maker/packages/whonix-gw-network-conf/lib/systemd/system/onion-grater.service.d/30_cpfpy.conf</code>
* gateway only<!--gateway-only-->
* Non-Qubes-Whonix only

onion-grater systemd unit file extension

Run <code>/usr/lib/onion-grater-merger</code> as root to avoid permission
conflicts.
<code>ExecStartPre=+/usr/lib/onion-grater-merger</code>

Reconfigure <code>onion-grater</code> to listen on network interface
<code>eth1</code>.
= Whonix-Workstation =
== anon-apps-config ==

* https://github.com/Whonix/anon-apps-config
* [https://github.com/Whonix/anon-apps-config/blob/master/debian/control debian/control]
===  anonymity, privacy and security settings pre-configuration ===

Most settings take effect for newly created user account onlys, and not
for existing user accounts.

Sets timezone to UTC.

Enables Menubar in Dolphin by default.

gnupg configuration for Anonymity Distributions:
* Sets `use-tor` in `/etc/skel/.gnupg/dirmngr.conf`.
* Ships Thunderbird torbirdy configuration file
`/etc/thunderbird/pref/30_whonix.js` that allows torified keyserver access.
* Deactivates KGpg's first run wizard. Disables tip of the day. Disables KGpg's systray.

Double click instead of single click in KDE.

Deactivates maximize windows when moved to the top.
In context of anonymity it might be better not to maximize the browser window
(https://gitlab.torproject.org/legacy/trac/-/issues/7255).
To prevent users from accidentally maximizing their browser window, it is
better when KDE's feature to maximize windows when moved to the top is
disabled.

Deactivates KDE's system sounds.

Disables KDE graphics effects. Disables some background processes.

Stream Isolation (proxy) settings for KDE apps for Anonymity Distributions
Configures global proxy settings, which acts as a fallback if no other proxy
settings are set, for KDE applications to socks 10.152.152.10:9122.
IP HARDCODED above but no need to change since it is description only.
Otherwise unconfigured KDE applications would use no proxy settings
(Transparent Proxying) if the anonymity distribution features a transparent
proxy.
Useful to improve stream isolation.
On the other hand, anonymity distributions not featuring transparent proxying
should probably not install this package by default, because then unconfigured
KDE applications should by default not be able to connect.

Sets Unlimited Scrollback in Konsole.

Disables klipper clipboard history.

Deactivates automatic updates for Package Manager APT and Apper
Useful in context of networks with limited traffic quota, slow networks and
anonymity distributions.
In latter case, the default automatic updates interval would be too
predictable (expectable amount of traffic every X), thus eventually be
vulnerable for traffic fingerprinting.
Disabling Apper automatic updates only takes effect for newly created user
accounts. Not for existing user accounts. This is most useful to help Linux
distribution maintainers setting divergent defaults.

Longer Timeouts for Package Manager APT
Raising timeout and retries using configuration snippet. Useful in context of
slow networks and anonymity distributions.

Ships a configuration file /etc/apt/apt.conf.d/90longer-timeouts to configure
apt-get.

Ships a configuration file /etc/skel/.config/vlc/vlcrc to configure VLC to not
ask for network policy at start and sets vout=xcb_x11 to enable VM
compatibility out-of-the-box.

Disabled gajim update manager by default for better security since it does not
verify software signatures by hiding file
/usr/share/gajim/plugins/plugin_installer/__init__.py using
'config-package-dev' 'hide'.

Disables systemd-resolved during boot unless file /etc/dns-enable exists.

Disables systemd-resolved fallback DNS (which by default is set to Google).

Removes capabilities from `/bin/ping` if
[security-misc](https://github.com/Kicksecure/security-misc) is
installed as ping doesn't work with Tor anyway and its capabilities are just
unneeded attack surface.

Create a dummy Tor binary '/home/user/.local/share/Bisq/btc_mainnet/tor/tor'
to avoid Tor over Tor.

Improves HexChat Privacy Settings
* As per: https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorifyHOWTO/XChat
* Moves the following files:
- `/usr/lib/xchat/plugins/python.so`
- `/usr/lib/xchat/plugins/tcl.so`
- `/usr/lib/xchat/plugins/perl.so`
to `/usr/share/anon-apps-config`, so these plugins get disabled by
default.

Due to technical limitations some settings only take effect for applications
being started for the very first time, i.e. when the user config of that
application in the user's home folder does not exist yet. Works best for new
user accounts.

This package is most useful to help Linux distribution maintainers setting
divergent defaults.

=== /etc/apt/apt.conf.d/90longer-timeouts ===

* [https://github.com/Whonix/anon-apps-config/blob/master/etc/apt/apt.conf.d/90longer-timeouts /etc/apt/apt.conf.d/90longer-timeouts]
* <code>~/derivative-maker/packages/anon-apps-config/etc/apt/apt.conf.d/90longer-timeouts</code>

longer APT timeouts and more retires
=== /lib/systemd/system/systemd-resolved.service.d/40_anon-apps-config.conf ===

* [https://github.com/Whonix/anon-apps-config/blob/master/usr/lib/systemd/system/systemd-resolved.service.d/40_anon-apps-config.conf /lib/systemd/system/systemd-resolved.service.d/40_anon-apps-config.conf]
* <code>~/derivative-maker/packages/anon-apps-config/lib/systemd/system/systemd-resolved.service.d/40_anon-apps-config.conf</code>

Disable <code>systemd-resolved</code> unless file
<code>/etc/dns-enable</code> exists.
=== /usr/lib/systemd/resolved.conf.d/40_anon-apps-config.conf ===

* [https://github.com/Whonix/anon-apps-config/blob/master/usr/lib/systemd/resolved.conf.d/40_anon-apps-config.conf /usr/lib/systemd/resolved.conf.d/40_anon-apps-config.conf]
* <code>~/derivative-maker/packages/anon-apps-config/usr/lib/systemd/resolved.conf.d/40_anon-apps-config.conf</code>


do not default to using Google nameservers
https://phabricator.whonix.org/T793
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=761658
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=761658#216
https://www.freedesktop.org/software/systemd/man/systemd-resolved.service.html
https://forums.whonix.org/t/os-generated-network-traffic
* <code>[Resolve]</code>
* <code>FallbackDNS=</code>

=== /usr/share/anon-apps-config/kioslaverc ===

* [https://github.com/Whonix/anon-apps-config/blob/master/usr/share/anon-apps-config/kioslaverc /usr/share/anon-apps-config/kioslaverc]
* <code>~/derivative-maker/packages/anon-apps-config/usr/share/anon-apps-config/kioslaverc</code>

KDE stream isolation settings.

* <code>[Proxy Settings]</code>
* <code>NoProxyFor=127.0.0.1</code>
* <code>ProxyType=1</code>
* <code>ReversedException=false</code>
IP HARDCODED
* <code>socksProxy=http://10.152.152.10 9122</code>

=== /usr/share/anon-apps-config/ksmserverrc ===

* [https://github.com/Whonix/anon-apps-config/blob/master/usr/share/anon-apps-config/ksmserverrc /usr/share/anon-apps-config/ksmserverrc]
* <code>~/derivative-maker/packages/anon-apps-config/usr/share/anon-apps-config/ksmserverrc</code>

disable session saving
https://forums.whonix.org/t/kdesudo-error-popup-window-sdwdate-gui
* <code>loginMode=default</code>
== anon-ws-disable-stacked-tor ==

* https://github.com/Whonix/anon-ws-disable-stacked-tor
* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/debian/control debian/control]
===  Prevents Tor over Tor in Anonymity Distribution Workstations ===

Supposed to be installed on Workstations, which prevents installing the real
Tor package from upstream (ex: Debian, The Tor Project) APT repositories. Its
purpose is to prevent, running Tor over Tor.

It allows installation of packages, which depend on Tor, such as TorChat,
parcimonie and torbrowser-launcher.

This package uses the "Provides: tor" field[1], which should avoid any kinds of
conflicts, in case upstream releases a higher version of Tor. This won't work
for packages, which depend on an explicit version of Tor (such as TorChat).
This is non-ideal, since for example the torchat package will install Tor, but
still acceptable, because of the following additional implementations.

Binaries eventually installed (by the tor Debian package) /usr/bin/tor as well
as /usr/sbin/tor are replaced with a dummy wrapper that does nothing
(dpkg-diverted using config-package-dev).

systemd-socket-proxyd listens on Tor's default ports. system Tor's
127.0.0.1:9050, 127.0.0.1:9051 and TBB's 127.0.0.1:9150, 127.0.0.1:9051,
which prevents the
default Tor Browser Bundle or Tor package by The Tor Project from opening
these default ports, which will result in Tor failing to open its listening
port and therefore exiting, thus preventing Tor over Tor.

See also:

* https://www.whonix.org/wiki/Dev/anon-ws-disable-stacked-tor
* https://tor.stackexchange.com/questions/427/is-running-tor-over-tor-dangerous

[1] See "7.5 Virtual packages - Provides" on
https://www.debian.org/doc/debian-policy/ch-relationships.html

This package is produced independently of, and carries no guarantee from,
The Tor Project.
=== /debian/anon-ws-disable-stacked-tor.displace ===

* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/debian/anon-ws-disable-stacked-tor.displace /debian/anon-ws-disable-stacked-tor.displace]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/debian/anon-ws-disable-stacked-tor.displace</code>
* workstation only<!--workstation-only-->

<code>config-package-dev</code> <code>displace</code> the following files:

* <code>/etc/default/tor.anondist</code>
* <code>/usr/bin/tor.anondist</code>
* <code>/usr/sbin/tor.anondist</code>

=== /debian/anon-ws-disable-stacked-tor.postinst ===

* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/debian/anon-ws-disable-stacked-tor.postinst /debian/anon-ws-disable-stacked-tor.postinst]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/debian/anon-ws-disable-stacked-tor.postinst</code>
* workstation only<!--workstation-only-->

<code>/etc/X11/Xsession.d/</code> hook to <code>source</code>
<code>/usr/lib/anon-ws-disable-stacked-tor/torbrowser.sh</code>

Add user "user" to the group "debian-tor", so user "user" can access Tor's control port.
User "user" already exists thanks to the dist-base-files package.
* <code>addgroup --quiet user debian-tor</code>

=== /etc/anon-ws-disable-stacked-tor.d/30_anon-dist.conf ===

* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/etc/anon-ws-disable-stacked-tor.d/30_anon-dist.conf /etc/anon-ws-disable-stacked-tor.d/30_anon-dist.conf]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/etc/anon-ws-disable-stacked-tor.d/30_anon-dist.conf</code>
* workstation only<!--workstation-only-->

<code>systemd-unit-files-generator</code> and <code>socat-unix-sockets</code> configuration examples.
=== /etc/profile.d/20_torbrowser.sh ===

* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/etc/profile.d/20_torbrowser.sh /etc/profile.d/20_torbrowser.sh]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/etc/profile.d/20_torbrowser.sh</code>
* workstation only<!--workstation-only-->

<code>/etc/profile.d</code> hook to <code>source</code>
<code>/usr/lib/anon-ws-disable-stacked-tor/torbrowser.sh</code>
=== /etc/rsyslog.d/anon-ws-disable-stacked-tor.conf ===

* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/etc/rsyslog.d/anon-ws-disable-stacked-tor.conf /etc/rsyslog.d/anon-ws-disable-stacked-tor.conf]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/etc/rsyslog.d/anon-ws-disable-stacked-tor.conf</code>
* workstation only<!--workstation-only-->

rsyslog configuration drop-in snippet

No longer required since no longer using rinetd.

Workaround for:
'rinetd fills up the logs until disk is full up if it cannot bind'
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796235
* <code>:msg, contains, "accept(0): Socket operation on non-socket" stop</code>

=== /etc/X11/Xsession.d/20torbrowser ===

* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/etc/X11/Xsession.d/20torbrowser /etc/X11/Xsession.d/20torbrowser]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/etc/X11/Xsession.d/20torbrowser</code>
* workstation only<!--workstation-only-->

<code>/etc/X11/Xsession.d/</code> hook to <code>source</code>
<code>/usr/lib/anon-ws-disable-stacked-tor/torbrowser.sh</code>
=== /lib/systemd/system/anon-ws-disable-stacked-tor.service ===

* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/usr/lib/systemd/system/anon-ws-disable-stacked-tor.service /lib/systemd/system/anon-ws-disable-stacked-tor.service]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/lib/systemd/system/anon-ws-disable-stacked-tor.service</code>
* workstation only<!--workstation-only-->

Runs <code>/usr/lib/anon-ws-disable-stacked-tor/state-files</code> and
<code>/usr/lib/anon-ws-disable-stacked-tor/socat-unix-sockets</code>.
=== /lib/systemd/system/tor@default.service.d/50_anon_ws_disable_stacked_tor.conf ===

* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/usr/lib/systemd/system/tor@default.service.d/50_anon_ws_disable_stacked_tor.conf /lib/systemd/system/tor@default.service.d/50_anon_ws_disable_stacked_tor.conf]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/lib/systemd/system/tor@default.service.d/50_anon_ws_disable_stacked_tor.conf</code>
* workstation only<!--workstation-only-->

Qubes-Whonix:

Clear 'ConditionPathExists=/run/qubes-service/whonix-gateway' set by
the qubes-whonix package, which is useful on the gateway but not on the
workstation.

In effect the dummy Tor service will run on Whonix-Workstation.

* <code>ConditionPathExists=</code>

=== /lib/systemd/system/tor@default.service.d/51_anon_ws_disable_stacked_tor.conf ===

* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/usr/lib/systemd/system/tor@default.service.d/51_anon_ws_disable_stacked_tor.conf /lib/systemd/system/tor@default.service.d/51_anon_ws_disable_stacked_tor.conf]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/lib/systemd/system/tor@default.service.d/51_anon_ws_disable_stacked_tor.conf</code>
* workstation only<!--workstation-only-->

Compatibility with system Tor package.

Overrides systemd unit file by system Tor package for compatibility so
the dummy Tor binary <code>/usr/bin/tor</code> gets load instead.

Makes all <code>systemctl</code> <code>restart</code> <code>reload</code>
<code>status</code> commands compatible with dummy Tor.
=== /lib/systemd/system/tor.service.d/50_anon_ws_disable_stacked_tor.conf ===

* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/usr/lib/systemd/system/tor.service.d/50_anon_ws_disable_stacked_tor.conf /lib/systemd/system/tor.service.d/50_anon_ws_disable_stacked_tor.conf]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/lib/systemd/system/tor.service.d/50_anon_ws_disable_stacked_tor.conf</code>
* workstation only<!--workstation-only-->

Make 'sudo service tor status' exit '0' for better compatibility.
* <code>RemainAfterExit=yes</code>
=== /usr/bin/tor.anondist ===

* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/usr/bin/tor.anondist /usr/bin/tor.anondist]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/usr/bin/tor.anondist</code>
* workstation only<!--workstation-only-->

dummy Tor wrapper doing nothing but wait forever and

OnionShare support for configuration option "bundled Tor".
=== /usr/lib/anon-ws-disable-stacked-tor/socat-unix-sockets ===

* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/usr/libexec/anon-ws-disable-stacked-tor/socat-unix-sockets /usr/lib/anon-ws-disable-stacked-tor/socat-unix-sockets]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/usr/lib/anon-ws-disable-stacked-tor/socat-unix-sockets</code>
* workstation only<!--workstation-only-->

<code>socat-unix-sockets</code> starter.
=== /usr/lib/anon-ws-disable-stacked-tor/state-files ===

* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/usr/libexec/anon-ws-disable-stacked-tor/state-files /usr/lib/anon-ws-disable-stacked-tor/state-files]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/usr/lib/anon-ws-disable-stacked-tor/state-files</code>
* workstation only<!--workstation-only-->

Emulates Tor by copying and chmodding the correct state files such as
<code>/run/tor/control.authcookie</code>.
=== /usr/lib/anon-ws-disable-stacked-tor/systemd-unit-files-generator ===

* [https://github.com/{{project_name_short}}/anon-ws-disable-stacked-tor/blob/master/usr/libexec/anon-ws-disable-stacked-tor/systemd-unit-files-generator /usr/lib/anon-ws-disable-stacked-tor/systemd-unit-files-generator]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/usr/lib/anon-ws-disable-stacked-tor/systemd-unit-files-generator</code>
* workstation only<!--workstation-only-->

Generates systemd unit files in
<code>/lib/systemd/system/anon-ws-disable-stacked-tor_autogen_*</code> which
listen on common local ports used by popular Tor applications such as Tor
Browser.

Redirect Whonix-Workstation port <code>9050</code> to Whonix-Gateway port
<code>9050</code> and so forth.

Create a unix domain socket files such as
/run/anon-ws-disable-stacked-tor/127.0.0.1_9050.sock and forward those
to $GATEWAY_IP:9150 etc. See also:
https://phabricator.whonix.org/T192

system Tor default SocksSocket is /run/tor/socks
redirect Whonix-Workstation unix domain socket file /run/tor/socks to Whonix-Gateway port 9050

Debian /usr/share/tor/tor-service-defaults-torrc uses '/run/tor/control' Tor ControlSocket
Redirect Whonix-Workstation unix domain socket file /run/tor/control to Whonix-Gateway port 9051
=== /usr/lib/anon-ws-disable-stacked-tor/torbrowser.sh ===

* [https://github.com/{{project_name_short}}/anon-ws-disable-stacked-tor/blob/master/usr/libexec/anon-ws-disable-stacked-tor/torbrowser.sh /usr/lib/anon-ws-disable-stacked-tor/torbrowser.sh]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/usr/lib/anon-ws-disable-stacked-tor/torbrowser.sh</code>
* workstation only<!--workstation-only-->

Environment variables for Tor Browser integration.

Prevents Tor over Tor.

Deactivate tor-launcher,
a Vidalia replacement as browser extension,
to prevent running Tor over Tor.
https://gitlab.torproject.org/legacy/trac/-/issues/6009
https://gitweb.torproject.org/tor-launcher.git
* <code>export TOR_SKIP_LAUNCH=1</code>

The following TOR_SOCKS_HOST and TOR_SOCKS_PORT variables
do not work flawlessly, due to an upstream bug in Tor Button:
   "TOR_SOCKS_HOST, TOR_SOCKS_PORT regression"
   https://gitlab.torproject.org/legacy/trac/-/issues/8336
(As an alternative,
   /home/user/tor-browser/Browser/TorBrowser/Data/Browser/profile.default/user.js
could be used.)
Fortunately, this is not required for {{project_name_short}} by default anymore,
because systemd-socket-proxyd is configured to redirect
Whonix-Workstation ports
IP HARDCODED but no need to change since comment only.
127.0.0.1:9050 to Whonix-Gateway 10.152.152.10:9050
127.0.0.1:9051 to Whonix-Gateway 10.152.152.10:9051
127.0.0.1:9150 to Whonix-Gateway 10.152.152.10:9150
127.0.0.1:9151 to Whonix-Gateway 10.152.152.10:9151
<code>#export TOR_SOCKS_HOST="10.152.152.10"</code><br />
<code>#export TOR_SOCKS_PORT="9150"</code><br />
<code>#export TOR_CONTROL_HOST="127.0.0.1"</code><br />
<code>#export TOR_CONTROL_PORT="9151"</code><br />
this is to satisfy Tor Button just filled up with anything
<code>#export TOR_CONTROL_PASSWD='"password"'</code><br />

We are not using TOR_TRANSPROXY=1 because that would break Tor Browser's
per tab stream isolation. (Tor Browser talks to a Tor SocksPort and sets a
socks user name and Tor is using IsolateSOCKSAuth by Tor default.)
<code>#export TOR_TRANSPROXY=1</code><br />

Environment variable to configure Tor Browser to use a pre existing unix
domain socket file instead of creating its own one to avoid Tor over Tor and
to keep it being able to connect.
systemd-socket-proxyd is being used for creation of unix domain socket file
/run/anon-ws-disable-stacked-tor/127.0.0.1_9150.sock and forwarding it to
to Whonix-Gateway port 9150.
https://phabricator.whonix.org/T192
https://gitlab.torproject.org/legacy/trac/-/issues/20111#comment:5
* <code>export TOR_SOCKS_IPC_PATH="/run/anon-ws-disable-stacked-tor/127.0.0.1_9150.sock"</code>
* <code>export TOR_CONTROL_IPC_PATH="/run/anon-ws-disable-stacked-tor/127.0.0.1_9151.sock"</code>

environment variable to skip TorButton control port verification
https://gitlab.torproject.org/legacy/trac/-/issues/13079
* <code>export TOR_SKIP_CONTROLPORTTEST=1</code>

Environment variable to disable the "TorButton" ->
"Open Network Settings..." menu item. It is not useful and confusing to have
on a workstation, because Tor must be configured on the Whonix-Gateway, which is
for security reasons forbidden from the Whonix-Gateway.
https://gitlab.torproject.org/legacy/trac/-/issues/14100
https://www.whonix.org/wiki/Tor_Browser/Advanced_Users#Open_Network_Settings
* <code>export TOR_NO_DISPLAY_NETWORK_SETTINGS=1</code>

=== /usr/lib/tmpfiles.d/anon-ws-disable-stacked-tor.conf ===

* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/usr/lib/tmpfiles.d/anon-ws-disable-stacked-tor.conf /usr/lib/tmpfiles.d/anon-ws-disable-stacked-tor.conf]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/usr/lib/tmpfiles.d/anon-ws-disable-stacked-tor.conf</code>
* workstation only<!--workstation-only-->

Create folder <code>/run/anon-ws-disable-stacked-tor</code>.

* <code>d /run/anon-ws-disable-stacked-tor 0775 root root</code>

=== /usr/sbin/tor.anondist ===

* [https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/usr/sbin/tor.anondist /usr/sbin/tor.anondist]
* <code>~/derivative-maker/packages/anon-ws-disable-stacked-tor/usr/sbin/tor.anondist</code>
* workstation only<!--workstation-only-->

dummy Tor wrapper doing nothing but wait forever.
== bindp ==

* https://github.com/Whonix/bindp
* [https://github.com/Whonix/bindp/blob/master/debian/control debian/control]
===  Binding specific IP and Port for Linux Running Application ===

This package is probably most useful for Anonymity Distributions.

This package is produced independently of, and carries no guarantee from,
The Tor Project.
=== /debian/bindp.postinst ===

* [https://github.com/Whonix/bindp/blob/master/debian/bindp.postinst /debian/bindp.postinst]
* <code>~/derivative-maker/packages/bindp/debian/bindp.postinst</code>
* workstation only<!--workstation-only-->

Compiles <code>/usr/lib/bindp.c</code> to <code>/usr/lib/libindp.so</code>
during package installation using <code>gcc</code>.
== whonix-ws-network-conf ==

* https://github.com/Whonix/whonix-ws-network-conf
* [https://github.com/Whonix/whonix-ws-network-conf/blob/master/debian/control debian/control]
===  Network Configuration for Whonix-Workstation ===

Includes /etc/network/interfaces for Whonix-Workstation.

Sets up an internal network interface eth0.

DNS configuration Anonymity Linux Distribution Workstations
Whether a Anonymity Linux Distribution Gateway supports anonymized system DNS
for Workstation's traffic (also known as Transparent DNS Proxy) mainly depends
on the Gateway's firewall.

This package is simply installing /etc/resolv.conf which points to
10.152.152.10, where an Anon-Gateway is supposed to provide a DnsPort on port
53. IP HARDCODED but no need to change because only description.

Currently relevant for Non-Qubes-Whonix only.
=== /debian/whonix-ws-network-conf.links ===

* [https://github.com/Whonix/whonix-ws-network-conf/blob/master/debian/whonix-ws-network-conf.links /debian/whonix-ws-network-conf.links]
* <code>~/derivative-maker/packages/whonix-ws-network-conf/debian/whonix-ws-network-conf.links</code>
* workstation only<!--workstation-only-->
* Non-Qubes-Whonix only


Disable Predictable Network Interface Names as these are problematic.
https://forums.whonix.org/t/whonix-14-0-0-0-7-developers-only/3449/4
Disabling them as per
'zless /usr/share/doc/udev/README.Debian.gz'.
* <code>/dev/null /etc/systemd/network/99-default.link</code>

=== /debian/whonix-ws-network-conf.triggers ===

* [https://github.com/Whonix/whonix-ws-network-conf/blob/master/debian/whonix-ws-network-conf.triggers /debian/whonix-ws-network-conf.triggers]
* <code>~/derivative-maker/packages/whonix-ws-network-conf/debian/whonix-ws-network-conf.triggers</code>
* workstation only<!--workstation-only-->
* Non-Qubes-Whonix only


Required for /etc/systemd/network/99-default.link to take effect as per
'zless /usr/share/doc/udev/README.Debian.gz'.
* <code>activate-noawait update-initramfs</code>

=== /etc/network/interfaces.d/30_non-qubes-whonix ===

* [https://github.com/Whonix/whonix-ws-network-conf/blob/master/etc/network/interfaces.d/30_non-qubes-whonix /etc/network/interfaces.d/30_non-qubes-whonix]
* <code>~/derivative-maker/packages/whonix-ws-network-conf/etc/network/interfaces.d/30_non-qubes-whonix</code>
* workstation only<!--workstation-only-->
* Non-Qubes-Whonix only

network interfaces configuration eth0 to communicate with Whonix-Gateway

static network configuration

IP HARDCODED but not need to change since only comment.
<code>#address 10.152.152.11</code><br />
<code>#netmask 255.255.192.0</code><br />
<code>#gateway 10.152.152.10</code><br />
=== /etc/resolv.conf.whonix ===

* [https://github.com/Whonix/whonix-ws-network-conf/blob/master/etc/resolv.conf.whonix /etc/resolv.conf.whonix]
* <code>~/derivative-maker/packages/whonix-ws-network-conf/etc/resolv.conf.whonix</code>

set <code>nameserver 10.152.152.10</code>
This works different in Qubes-Whonix.
= Shared by Whonix-Gateway and Whonix-Workstation =
== anon-apt-sources-list ==

* https://github.com/Kicksecure/anon-apt-sources-list
* [https://github.com/Kicksecure/anon-apt-sources-list/blob/master/debian/control debian/control]
===  /etc/apt/sources.list.d/debian.list for Anonymity Linux Distributions ===

A question of distribution maintenance strategies. The more standard
way would indeed be populating /etc/apt/sources.list at install or build time
and leaving /etc/apt/sources.list.d alone. The idea of managing
/etc/apt/sources.list.d/debian.list for the user is, the anonymity
distribution maintainers can decide when it is a better "change stable to
oldstable", "keep wheezy as long as needed to work out [eventual!] issues
that would break during upgrade to jessie" and such.
=== /etc/apt/sources.list.d/debian.list ===

* [https://github.com/Kicksecure/anon-apt-sources-list/blob/master/etc/apt/sources.list.d/debian.list /etc/apt/sources.list.d/debian.list]
* <code>~/derivative-maker/packages/anon-apt-sources-list/etc/apt/sources.list.d/debian.list</code>

Debian APT repository sources.list

Configured to use <code>tor+https</code>.

Technical notes:
- Why are sources (deb-src) disabled by default?
  Because those are not required by most users, to save time while
  running <code>sudo apt update</code>.
- See also: https://www.debian.org/security/
- See also: <code>/etc/apt/sources.list.d/</code>
== anon-shared-build-apt-sources-tpo ==

* https://github.com/Kicksecure/anon-shared-build-apt-sources-tpo
* [https://github.com/Kicksecure/anon-shared-build-apt-sources-tpo/blob/master/debian/control debian/control]
===  Adds TPO's APT repository to Anonymity Linux Distributions ===

Comes with "deb https://deb.torproject.org/torproject.org stable main", The Tor
Project's APT signing key.

This package is produced independently of, and carries no guarantee from,
The Tor Project.
=== /etc/apt/sources.list.d/torproject.list ===

* [https://github.com/Kicksecure/anon-shared-build-apt-sources-tpo/blob/master/etc/apt/sources.list.d/torproject.list /etc/apt/sources.list.d/torproject.list]
* <code>~/derivative-maker/packages/anon-shared-build-apt-sources-tpo/etc/apt/sources.list.d/torproject.list</code>
* Not installed by default.

Tor Project APT repository sources.list
== qubes-whonix ==

* https://github.com/Whonix/qubes-whonix
* [https://github.com/Whonix/qubes-whonix/blob/master/debian/control debian/control]
===  Qubes Configuration for Whonix-Gateway and Whonix-Workstation ===

This package contains all the scripts and configuration options to be able
to run Whonix-Gateway and Whonix-Workstation within a Qubes environment.

Whonix-Gateway should run as a ProxyVM.

Whonix-Workstation should run as an AppVM.

Template updates over Tor.

Package: qubes-whonix-shared-packages-recommended
Architecture: all
Depends: qubes-core-agent-passwordless-root | dummy-dependency,
qubes-kernel-vm-support, initramfs-tools, qubes-mgmt-salt-vm-connector,
qubes-usb-proxy, qubes-input-proxy-sender,
qubes-core-agent-thunar, qubes-core-agent-nautilus,
${misc:Depends}
Description: Recommended packages for Qubes-Whonix-Gateway and Qubes-Whonix-Workstation
===  Recommended packages for Qubes-Whonix-Gateway and Qubes-Whonix-Workstation ===

A metapackage, which includes recommended packages to ensure, Qubes-Whonix
standard tools are available and other useful recommended packages.

Safe to remove, if you know what you are doing.

Package: qubes-whonix-gateway-packages-recommended
Architecture: all
Depends: tinyproxy,
yum,
yum-utils,
qubes-core-agent-dom0-updates,
${misc:Depends}
Description: Recommended packages for Qubes-Whonix-Gateway
===  Recommended packages for Qubes-Whonix-Gateway ===

A metapackage, which installs packages, which are recommended for
Qubes-Whonix-Gateway.

Safe to remove, if you know what you are doing.

Package: qubes-whonix-workstation-packages-recommended
Architecture: all
Depends: qubes-thunderbird,
qubes-gpg-split,
qubes-pdf-converter,
qubes-img-converter,
pulseaudio-qubes,
${misc:Depends}
Description: Recommended packages for Qubes-Whonix-Workstation
===  Recommended packages for Qubes-Whonix-Workstation ===

A metapackage, which installs packages, which are recommended for
Qubes-Whonix-Workstation.

Feel free to remove, if you know what you are doing.
=== /etc/qubes/protected-files.d/qubes-whonix.conf ===

* [https://github.com/Whonix/qubes-whonix/blob/master/etc/qubes/protected-files.d/qubes-whonix.conf /etc/qubes/protected-files.d/qubes-whonix.conf]
* <code>~/derivative-maker/packages/qubes-whonix/etc/qubes/protected-files.d/qubes-whonix.conf</code>
* Qubes-Whonix only

Configure Qubes to not modify files shipped by Whonix:

* <code>/etc/hostname</code>
* <code>/etc/hosts</code>
* <code>/etc/localtime</code>
* <code>/etc/timezone</code>
* <code>/etc/resolv.conf</code>
=== /etc/uwt.d/40_qubes.conf ===

* [https://github.com/Whonix/qubes-whonix/blob/master/etc/uwt.d/40_qubes.conf /etc/uwt.d/40_qubes.conf]
* <code>~/derivative-maker/packages/qubes-whonix/etc/uwt.d/40_qubes.conf</code>
* Qubes-Whonix only

uwt Qubes-Whonix Integration

Runs only inside Qubes Template.

This configuration snippets configures [[#uwt|uwt]] to wait before running
<code>apt</code> until status file
<code>/run/updatesproxycheck/whonix-secure-proxy</code> or
status file
<code>/run/updatesproxycheck/whonix-secure-proxy-check-done</code>
exists. It will timeout after <code>120</code> seconds.

This is to determine if torified Qubes updates proxy was detected.

If torified Qubes updates proxy detection fails, it will prevent running
<code>apt</code> and show the following warning.

<blockquote>
WARNING: Execution of apt prevented by @file_name@ because no torified Qubes updates proxy found.
</blockquote>

If torified Qubes updates proxy detection succeeds, it will
disable apt uwtwrapper.
In other words, run apt normally. Run apt without <code>torsocks</code>.
Because <code>apt</code> config file.
<code>/etc/apt/apt.conf.d/01qubes-proxy</code> will already have http proxy
settings for TCP based Qubes Updates proxy
<code>Acquire::http::Proxy "http://10.137.255.254:8082/";</code>
or for qrexec based Qubes updates proxy.
<code>Acquire::http::Proxy "http://127.0.0.1:8082/";</code>
== ro-mode-init ==

* https://github.com/Whonix/ro-mode-init
* [https://github.com/Whonix/ro-mode-init/blob/master/debian/control debian/control]
===  Detects read-only disks and automatically enables live-boot ===

Allows booting the system in live mode. Meaning, no persistent modifications
will be written to the disk. All changes stay in RAM.

No claims are made with regard to anti forensics.
=== /debian/ro-mode-init.triggers ===

* [https://github.com/Whonix/ro-mode-init/blob/master/debian/ro-mode-init.triggers /debian/ro-mode-init.triggers]
* <code>~/derivative-maker/packages/ro-mode-init/debian/ro-mode-init.triggers</code>
* workstation only<!--workstation-only-->
* Non-Qubes-Whonix only


Make changes by ro-mode-init take effect.
* <code>activate-noawait update-initramfs</code>

== sdwdate ==

* https://github.com/Kicksecure/sdwdate
* [https://github.com/Kicksecure/sdwdate/blob/master/debian/control debian/control]
===  Secure Distributed Network Time Synchronization ===

Time keeping is crucial for security, privacy, and anonymity. Sdwdate is a Tor
friendly replacement for rdate and ntpdate that sets the system's clock by
communicating via onion encrypted TCP with Tor onion webservers.

At randomized intervals, sdwdate connects to a variety of webservers and
extracts the time stamps from http headers (RFC 2616).
Using sclockadj option, time is gradually adjusted preventing bigger clock
jumps that could confuse logs, servers, Tor, i2p, etc.

This package contains the sdwdate time fetcher and daemon. No
installation on remote servers required. To avoid conflicts, this daemon
should not be enabled together with ntp or tlsdated.
=== /etc/qubes/suspend-post.d/30_sdwdate.sh ===

* [https://github.com/Kicksecure/sdwdate/blob/master/etc/qubes/suspend-post.d/30_sdwdate.sh /etc/qubes/suspend-post.d/30_sdwdate.sh]
* <code>~/derivative-maker/packages/sdwdate/etc/qubes/suspend-post.d/30_sdwdate.sh</code>

hook to run <code>/usr/lib/sdwdate/suspend-post</code>
in Qubes-Whonix.
=== /etc/qubes/suspend-pre.d/30_sdwdate.sh ===

* [https://github.com/Kicksecure/sdwdate/blob/master/etc/qubes/suspend-pre.d/30_sdwdate.sh /etc/qubes/suspend-pre.d/30_sdwdate.sh]
* <code>~/derivative-maker/packages/sdwdate/etc/qubes/suspend-pre.d/30_sdwdate.sh</code>

hook to run <code>/usr/lib/sdwdate/suspend-pre</code>
in Qubes-Whonix.
== security-misc ==

* https://github.com/Kicksecure/security-misc
* [https://github.com/Kicksecure/security-misc/blob/master/debian/control debian/control]
===  Enhances Miscellaneous Security Settings ===

https://github.com/Kicksecure/security-misc/blob/master/README.md

https://www.whonix.org/wiki/Security-misc

Discussion:

Happening primarily in {{project_name_short}} forums.
https://forums.whonix.org/t/kernel-hardening/7296
=== /etc/sysctl.d/30_security-misc.conf ===

* [https://github.com/Kicksecure/security-misc/blob/master/etc/sysctl.d/30_security-misc.conf /etc/sysctl.d/30_security-misc.conf]
* <code>~/derivative-maker/packages/security-misc/etc/sysctl.d/30_security-misc.conf</code>

TCP/IP stack hardening

Protects against time-wait assassination.
It drops RST packets for sockets in the time-wait state.
* <code>net.ipv4.tcp_rfc1337=1</code>

Disables ICMP redirect acceptance.
* <code>net.ipv4.conf.all.accept_redirects=0</code>
* <code>net.ipv4.conf.default.accept_redirects=0</code>
* <code>net.ipv4.conf.all.secure_redirects=0</code>
* <code>net.ipv4.conf.default.secure_redirects=0</code>
* <code>net.ipv6.conf.all.accept_redirects=0</code>
* <code>net.ipv6.conf.default.accept_redirects=0</code>

Disables ICMP redirect sending.
* <code>net.ipv4.conf.all.send_redirects=0</code>
* <code>net.ipv4.conf.default.send_redirects=0</code>
* <code>net.ipv6.conf.all.accept_redirects=0</code>
* <code>net.ipv6.conf.default.accept_redirects=0</code>

Ignores ICMP requests.
* <code>net.ipv4.icmp_echo_ignore_all=1</code>

Enables TCP syncookies.
* <code>net.ipv4.tcp_syncookies=1</code>

Disable source routing.
* <code>net.ipv4.conf.all.accept_source_route=0</code>
* <code>net.ipv4.conf.default.accept_source_route=0</code>
* <code>net.ipv6.conf.all.accept_source_route=0</code>
* <code>net.ipv6.conf.default.accept_source_route=0</code>

Enable reverse path filtering to prevent IP spoofing and
mitigate vulnerabilities such as CVE-2019-14899.
https://forums.whonix.org/t/enable-reverse-path-filtering/8594
* <code>net.ipv4.conf.default.rp_filter=1</code>
* <code>net.ipv4.conf.all.rp_filter=1</code>

== uwt ==

* https://github.com/Whonix/uwt
* [https://github.com/Whonix/uwt/blob/master/debian/control debian/control]
===  Use Applications over Tor with Stream Isolation and Time Privacy ===

Can add "torsocks" and/or "timeprivacy" before invocation of applications when
configured to do so. For example, when simply typing "apt-get" instead of
"torsocks apt-get", "apt-get" can still be routed over Tor.

The uwt package comes with the following applications pre-configured to use
uwtwrapper, Tor and stream isolation:
- apt
- apt-file
- apt-get
- aptitude-curses
- curl
- git
- gpg
- gpg2
- mixmaster-update
- rawdog
- ssh
- wget
- yum
- yumdownloader
- wormhole

To circumvent a uwt wrapper on a by case base, you append ".anondist-real" to
the command, for example "apt-get.anondist-real". You can also deactivate
specific or all uwt wrappers by using the stackable .d-style configuration
folder /etc/uwt.d.

Uwt can only work only as good as torsocks. If torsocks is unable to route all
of an application's traffic over Tor, ex. if there is an leak, there will
also be one when using uwt. For that reason, it is recommended to use
Anonymity Distributions, that prevent such leaks.

If an applications has native support for socks proxy settings, those should
be preferred over uwt. Also refer to the TorifyHOWTO and your distribution's
documentation.

Timeprivacy can keep your time private. You can create wrappers for
applications and timeprivacy will feed those applications with a fake time,
which obfuscates at which time you really used that applications (such as when
you made the git commit or when you signed that document). It does NOT set
your time zone to UTC.

This package is probably most useful for Anonymity Distributions.

This package is produced independently of, and carries no guarantee from,
The Tor Project.
=== /debian/uwt.displace ===

* [https://github.com/Whonix/uwt/blob/master/debian/uwt.displace /debian/uwt.displace]
* <code>~/derivative-maker/packages/uwt/debian/uwt.displace</code>

replace the following files with the <code>uwt</code> version

Using <code>config-package-dev</code> <code>displace</code>.

<code>/etc/tor/torsocks</code> configuration file
* <code>/etc/tor/torsocks.conf.anondist</code>

Replace <code>apt</code>, <code>wget</code>, <code>curl</code>,
<code>ssh</code>, <code>onionshare</code>, <code>ricochet</code>,
<code>wormhole</code> with <code>uwt</code> wrapper which then calls
<code>/usr/lib/uwtwrapper</code>.
* <code>/usr/bin/apt.anondist</code>
* <code>/usr/bin/apt-file.anondist</code>
* <code>/usr/bin/apt-get.anondist</code>
* <code>/usr/bin/aptitude-curses.anondist</code>
* <code>/usr/bin/curl.anondist</code>
* <code>/usr/bin/git.anondist</code>
* <code>/usr/bin/gpg.anondist</code>
* <code>/usr/bin/gpg2.anondist</code>
* <code>/usr/bin/mixmaster-update.anondist</code>
* <code>/usr/bin/rawdog.anondist</code>
* <code>/usr/bin/ssh.anondist</code>
* <code>/usr/bin/wget.anondist</code>
* <code>/usr/bin/yum.anondist</code>
* <code>/usr/bin/yumdownloader.anondist</code>
* <code>/usr/bin/onionshare.anondist</code>
* <code>/usr/bin/onionshare-gui.anondist</code>
* <code>/usr/bin/ricochet.anondist</code>
* <code>/usr/bin/wormhole.anondist</code>

=== /etc/profile.d/20_uwt.sh ===

* [https://github.com/Whonix/uwt/blob/master/etc/profile.d/20_uwt.sh /etc/profile.d/20_uwt.sh]
* <code>~/derivative-maker/packages/uwt/etc/profile.d/20_uwt.sh</code>

<code>/etc/profile.d</code> hook to source <code>/usr/lib/uwt/uwt.sh</code>
=== /etc/sudoers.d/uwt ===

* [https://github.com/Whonix/uwt/blob/master/etc/sudoers.d/uwt /etc/sudoers.d/uwt]
* <code>~/derivative-maker/packages/uwt/etc/sudoers.d/uwt</code>

Disable torsocks warning spam such as.
[May 20 11:45:27] WARNING torsocks[2645]: [syscall] Unsupported syscall number 224. Denying the call (in tsocks_syscall() at syscall.c:165)
https://phabricator.whonix.org/T317
* <code>Defaults:ALL env_keep += "TORSOCKS_LOG_LEVEL"</code>
=== /etc/tor/torsocks.conf.anondist ===

* [https://github.com/Whonix/uwt/blob/master/etc/tor/torsocks.conf.anondist /etc/tor/torsocks.conf.anondist]
* <code>~/derivative-maker/packages/uwt/etc/tor/torsocks.conf.anondist</code>

<code>torsocks</code> configuration
* <code>AllowInbound 1</code>
* <code>AllowOutboundLocalhost 1</code>
* <code>IsolatePID 1</code>
=== /etc/uwt.d/30_uwt_default.conf ===

* [https://github.com/Whonix/uwt/blob/master/etc/uwt.d/30_uwt_default.conf /etc/uwt.d/30_uwt_default.conf]
* <code>~/derivative-maker/packages/uwt/etc/uwt.d/30_uwt_default.conf</code>

<code>uwt</code> configuration
=== /etc/X11/Xsession.d/20uwt ===

* [https://github.com/Whonix/uwt/blob/master/etc/profile.d/20_uwt.sh /etc/X11/Xsession.d/20uwt]
* <code>~/derivative-maker/packages/uwt/etc/X11/Xsession.d/20uwt</code>

<code>/etc/X11/Xsession.d</code> hook to source <code>/usr/lib/uwt/uwt.sh</code>
=== /usr/bin/apt.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/apt.anondist /usr/bin/apt.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/apt.anondist</code>

uwt wrapped application

* <code>export uwtwrapper_parent="${BASH_SOURCE[0]}"</code>
* <code>exec /usr/lib/uwtwrapper "$@"</code>

=== /usr/bin/apt-file.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/apt-file.anondist /usr/bin/apt-file.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/apt-file.anondist</code>

uwt wrapped application
=== /usr/bin/apt-get.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/apt-get.anondist /usr/bin/apt-get.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/apt-get.anondist</code>

uwt wrapped application
=== /usr/bin/aptitude-curses.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/aptitude-curses.anondist /usr/bin/aptitude-curses.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/aptitude-curses.anondist</code>

uwt wrapped application
=== /usr/bin/curl.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/curl.anondist /usr/bin/curl.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/curl.anondist</code>

uwt wrapped application

* <code>export uwtwrapper_parent="${BASH_SOURCE[0]}"</code>
* <code>exec /usr/lib/uwtwrapper "$@"</code>

=== /usr/bin/git.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/git.anondist /usr/bin/git.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/git.anondist</code>

uwt wrapped application
=== /usr/bin/gpg2.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/gpg2.anondist /usr/bin/gpg2.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/gpg2.anondist</code>

uwt wrapped application
=== /usr/bin/mixmaster-update.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/mixmaster-update.anondist /usr/bin/mixmaster-update.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/mixmaster-update.anondist</code>

uwt wrapped application
=== /usr/bin/onionshare-gui.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/onionshare-gui.anondist /usr/bin/onionshare-gui.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/onionshare-gui.anondist</code>

uwt wrapped application
=== /usr/bin/rawdog.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/rawdog.anondist /usr/bin/rawdog.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/rawdog.anondist</code>

uwt wrapped application
=== /usr/bin/ricochet.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/ricochet.anondist /usr/bin/ricochet.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/ricochet.anondist</code>

uwt wrapped application

ricochet does not have unix domain socket file support, therefore it depends
on the TOR_CONTROL_HOST and TOR_CONTROL_PORT environment variables being
set. Otherwise it would try to start its own Tor instance.
https://phabricator.whonix.org/T444
* <code>TOR_CONTROL_HOST="127.0.0.1"</code>
* <code>TOR_CONTROL_PORT="9151"</code>
* <code>export TOR_CONTROL_HOST</code>
* <code>export TOR_CONTROL_PORT</code>

* <code>export uwtwrapper_parent="${BASH_SOURCE[0]}"</code>
* <code>exec /usr/lib/uwtwrapper "$@"</code>
=== /usr/bin/ssh.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/ssh.anondist /usr/bin/ssh.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/ssh.anondist</code>

uwt wrapped application
=== /usr/bin/time_privacy ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/time_privacy /usr/bin/time_privacy]
* <code>~/derivative-maker/packages/uwt/usr/bin/time_privacy</code>

undocumented
=== /usr/bin/wget.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/wget.anondist /usr/bin/wget.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/wget.anondist</code>

uwt wrapped application
=== /usr/bin/wormhole.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/wormhole.anondist /usr/bin/wormhole.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/wormhole.anondist</code>

uwt wrapped application
=== /usr/bin/yum.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/yum.anondist /usr/bin/yum.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/yum.anondist</code>

uwt wrapped application
=== /usr/bin/yumdownloader.anondist ===

* [https://github.com/Whonix/uwt/blob/master/usr/bin/yumdownloader.anondist /usr/bin/yumdownloader.anondist]
* <code>~/derivative-maker/packages/uwt/usr/bin/yumdownloader.anondist</code>

uwt wrapped application
=== /usr/lib/uwt/uwt.sh ===

* [https://github.com/Whonix/uwt/blob/master/usr/libexec/uwt/uwt.sh /usr/lib/uwt/uwt.sh]
* <code>~/derivative-maker/packages/uwt/usr/lib/uwt/uwt.sh</code>


Disable torsocks warning spam such as.
[May 20 11:45:27] WARNING torsocks[2645]: [syscall] Unsupported syscall number 224. Denying the call (in tsocks_syscall() at syscall.c:165)
https://phabricator.whonix.org/T317
* <code>export TORSOCKS_LOG_LEVEL=1</code>

=== /usr/lib/uwtexec ===

* [https://github.com/Whonix/uwt/blob/master/usr/libexec/uwt/uwtexec /usr/lib/uwtexec]
* <code>~/derivative-maker/packages/uwt/usr/lib/uwtexec</code>


This script is used by uwtwrapper as a workaround to preserve the zeroth
argument when executing programs with other wrappers like faketime or torsocks.

=== /usr/lib/uwt_settings_show ===

* [https://github.com/Whonix/uwt/blob/master/usr/libexec/uwt/uwt_settings_show /usr/lib/uwt_settings_show]
* <code>~/derivative-maker/packages/uwt/usr/lib/uwt_settings_show</code>


* <code>echo "uwt INFO: Stream isolation for some applications enabled. uwt / torsocks will be automatically prepended to some commands. What is that? See:"</code>
* <code>echo "uwt INFO: https://www.whonix.org/wiki/Stream_Isolation/Easy"</code>

=== /usr/lib/uwtwrapper ===

* [https://github.com/Whonix/uwt/blob/master/usr/libexec/uwt/uwtwrapper /usr/lib/uwtwrapper]
* <code>~/derivative-maker/packages/uwt/usr/lib/uwtwrapper</code>

When running uwt wrapped applications (such as <code>apt</code>,
<code>wget</code>, <code>curl</code>, <code>onionshare</code> or others)
automatically prepend <code>torsocks</code> or <code>bindp</code>. I.e.

When for example <code>apt</code> or <code>curl</code> is executed, what
really happens is running <code>torsocks apt</code> or
<code>torsocks curl</code>.

uwtwrappers and <code>/usr/lib/uwtwrapper</code> are hacks to socksify applications
that do
not support native socks proxy settings. Used to implement Stream Isolation.
https://www.whonix.org/wiki/Stream_Isolation

In essence, uwtwrappers are installed so users can type commands like
apt-get normally while transparently injecting torsocks, thereby stream
isolating them.

To understand better how uwt wrappers function, you could for example open
/usr/bin/apt-get.anondist in an editor.

Also useful to run:
ls -la /usr/bin/apt-get*

You will see, that /usr/bin/apt-get has been replaced with a symlink to
/usr/bin/apt-get.anondist. (This was done using config-package-dev.)

/usr/bin/apt-get.anondist is a uwt wrapper.

/usr/bin/apt-get.anondist-orig is the original apt-get binary.

<code>bindp</code> is used to make applications which listen on the internal
IP by default such as <code>onionshare</code> (which is the right thing to
outside of Whonix) listen on the external IP instead. See also:

* https://github.com/Whonix/bindp
* https://phabricator.whonix.org/T561
== whonix-base-files ==

* https://github.com/Whonix/whonix-base-files
* [https://github.com/Whonix/whonix-base-files/blob/master/debian/control debian/control]
===  {{project_name_short}} base system miscellaneous files ===

This package contains several important miscellaneous files, such as
/etc/issue, /etc/motd, /etc/dpkg/origins/whonix,
/etc/skel/.bashrc, /usr/bin/whonix, and others.

Anonymized operating system user name `user`, `/etc/hostname`, `/etc/hosts`,
`/etc/machine-id`, `/var/lib/dbus/machine-id`, which should be shared among
all anonymity distributions. See also:

* https://web.archive.org/web/20170630045108/https://mailman.boum.org/pipermail/tails-dev/2013-January/002457.html
* https://gitlab.tails.boum.org/tails/tails/-/issues/5655
* https://lists.autistici.org/message/20140627.215105.24023267.en.html

Sets the WHONIX environment variable to 1 as well.

Ships marker files:
* /usr/share/whonix/marker
* /usr/share/anon-dist/marker
=== /etc/hosts.whonix ===

* [https://github.com/Whonix/whonix-base-files/blob/master/etc/hosts.whonix /etc/hosts.whonix]
* <code>~/derivative-maker/packages/whonix-base-files/etc/hosts.whonix</code>

Debian default /etc/hosts + Anonymity Distribution specific additions.

Currently only <code>127.0.0.1 host.localdomain host</code> gets added.
== whonix-firewall ==

* https://github.com/Whonix/whonix-firewall
* [https://github.com/Whonix/whonix-firewall/blob/master/debian/control debian/control]
===  Firewall for Whonix-Gateway and Whonix-Workstation ===

iptables rules script and firewall configuration file for Whonix-Gateway and
Whonix-Workstation.

Whonix-Gateway Firewall Features:
- transparent proxying
- stream isolation
- reject invalid packages
- fail closed mechanism
- optional VPN-Firewall
- optional isolating proxy
- optional incoming flash proxy
- optional Tor relay

Do not remove, unless you no longer wish to use Whonix.
=== /debian/whonix-firewall.postinst ===

* [https://github.com/Whonix/whonix-firewall/blob/master/debian/whonix-firewall.postinst /debian/whonix-firewall.postinst]
* <code>~/derivative-maker/packages/whonix-firewall/debian/whonix-firewall.postinst</code>

Creates linux user accounts used by firewall script
clearnet tunnel notunnel systemcheck sdwdate updatesproxycheck.

Creates empty /etc/whonix_firewall.d/50_user.conf which is not owned
by any package if not existing.
=== /etc/whonix_firewall.d/30_whonix_gateway_default.conf ===

* [https://github.com/Whonix/whonix-firewall/blob/master/etc/whonix_firewall.d/30_whonix_gateway_default.conf /etc/whonix_firewall.d/30_whonix_gateway_default.conf]
* <code>~/derivative-maker/packages/whonix-firewall/etc/whonix_firewall.d/30_whonix_gateway_default.conf</code>
* gateway only<!--gateway-only-->
 {{project_name_short}} firewall configuration file
=== /etc/whonix_firewall.d/30_whonix_host_default.conf ===

* [https://github.com/Whonix/whonix-firewall/blob/master/etc/whonix_firewall.d/30_whonix_host_default.conf /etc/whonix_firewall.d/30_whonix_host_default.conf]
* <code>~/derivative-maker/packages/whonix-firewall/etc/whonix_firewall.d/30_whonix_host_default.conf</code>

undocumented
=== /etc/whonix_firewall.d/30_whonix_workstation_default.conf ===

* [https://github.com/Whonix/whonix-firewall/blob/master/etc/whonix_firewall.d/30_whonix_workstation_default.conf /etc/whonix_firewall.d/30_whonix_workstation_default.conf]
* <code>~/derivative-maker/packages/whonix-firewall/etc/whonix_firewall.d/30_whonix_workstation_default.conf</code>
* workstation only<!--workstation-only-->
 {{project_name_short}} firewall configuration file
=== /lib/systemd/system/networking.service.d/30_whonix-gw-firewall-fail-closed.conf ===

* [https://github.com/Whonix/whonix-firewall/blob/master/usr/lib/systemd/system/networking.service.d/30_whonix-gw-firewall-fail-closed.conf /lib/systemd/system/networking.service.d/30_whonix-gw-firewall-fail-closed.conf]
* <code>~/derivative-maker/packages/whonix-firewall/lib/systemd/system/networking.service.d/30_whonix-gw-firewall-fail-closed.conf</code>

Fail Closed Mechanism.
When the {{project_name_short}} firewall systemd service failed, do not bring up the
network.

TODO: does not cover Qubes-Whonix since Qubes does not use networking.service.
TODO: disabled, broken. Breaks networking on package upgrades.
https://phabricator.whonix.org/T875

<code>#[Unit]</code><br />
<code>#After=whonix-firewall.service</code><br />
<code>#Requires=whonix-firewall.service</code><br />

=== /lib/systemd/system/whonix-firewall.service ===

* [https://github.com/Whonix/whonix-firewall/blob/master/usr/lib/systemd/system/whonix-firewall.service /lib/systemd/system/whonix-firewall.service]
* <code>~/derivative-maker/packages/whonix-firewall/lib/systemd/system/whonix-firewall.service</code>

Runs <code>/usr/lib/whonix-firewall/enable-firewall</code>.

On Whonix-Gateway or Whonix-Workstation (if
<code>/usr/share/anon-gw-base-files/gateway</code> or
<code>/usr/share/anon-ws-base-files/workstation</code> exists),
loads {{project_name_short}} Firewall.

(Does nothing inside Qubes Templates.)

If loading {{project_name_short}} Firewall fails, creates
<code>/run/anon-firewall/failed.status</code>.
=== /usr/bin/whonix_firewall ===

* [https://github.com/Whonix/whonix-firewall/blob/master/usr/bin/whonix_firewall /usr/bin/whonix_firewall]
* <code>~/derivative-maker/packages/whonix-firewall/usr/bin/whonix_firewall</code>

firewall starter wrapper
=== /usr/bin/whonix-gateway-firewall ===

* [https://github.com/Whonix/whonix-firewall/blob/master/usr/bin/whonix-gateway-firewall /usr/bin/whonix-gateway-firewall]
* <code>~/derivative-maker/packages/whonix-firewall/usr/bin/whonix-gateway-firewall</code>

firewall script
=== /usr/bin/whonix-workstation-firewall ===

* [https://github.com/Whonix/whonix-firewall/blob/master/usr/bin/whonix-workstation-firewall /usr/bin/whonix-workstation-firewall]
* <code>~/derivative-maker/packages/whonix-firewall/usr/bin/whonix-workstation-firewall</code>

firewall script
=== /usr/lib/whonix-firewall/enable-firewall ===

* [https://github.com/Whonix/whonix-firewall/blob/master/usr/libexec/whonix-firewall/enable-firewall /usr/lib/whonix-firewall/enable-firewall]
* <code>~/derivative-maker/packages/whonix-firewall/usr/lib/whonix-firewall/enable-firewall</code>

Wrapper to start firewall and create failure status files on failure.
=== /usr/share/whonix-ws-firewall/unit_tests/stream_isolation_test ===

* [https://github.com/Whonix/whonix-firewall/blob/master/usr/share/whonix-ws-firewall/unit_tests/stream_isolation_test /usr/share/whonix-ws-firewall/unit_tests/stream_isolation_test]
* <code>~/derivative-maker/packages/whonix-firewall/usr/share/whonix-ws-firewall/unit_tests/stream_isolation_test</code>

stream isolation developer test script