Combine Kicksecure ™ Live VMs with Read-only Mode for Virtual Hard Drives
Donate
Set virtual machine (VM) hard drives to read only. Prevent write access to VM drives.
Introduction[edit]
It is possible to optionally set the virtual machine (VM) disks to read-only. This increases the security of Live Mode in the VM, because otherwise malware running as root in the VM could theoretically mount the image read-write and gain persistence in this way.
Read-only Mode Configuration[edit]
Qubes[edit]
grub-live is currently unsupported on Qubes, but may become available in the future. Refer to the following forum discussion
for further information.
In Qubes R4, Qubes DisposableVMs are a suitable alternative.
VirtualBox[edit]
1. Set the VM disks to read-only.
Follow these steps:
- Power off the virtual machine (VM).
- Set the disk to read-only.
- The name of the VM in the following example below is
Kicksecure-XFCE. It could be replaced with the name of any other VM such asKicksecure-XFCE. - On the host command line, run.
- The name of the VM in the following example below is
VBoxManage setextradata Kicksecure-XFCE "VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly" 1
2. Remove VirtualBox virtual DVD drive.
This is only required if the VM has a virtual DVD drive. It is not required in Kicksecure ™ version 15.0.1.2.7 and above since it no longer comes with a virtual DVD drive by default. See footnote for a Kicksecure ™ build version lower than 15.0.1.2.7. [1]
3. Launch the live system.
Following reboot, a second boot entry called "VM Live Mode-mode" will be visible. Select it and then press Enter to boot the live system and use it as normal.
4. Optional: Revert the read-only change.
To boot into normal mode again, run this command on the host to revert the change.
VBoxManage setextradata Kicksecure-XFCE "VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly"
The normal boot option can now be selected in the GRUB menu.
5. Optional: Re-add the virtual DVD.
Only when you need this; see footnotes. [2]
Troubleshooting: If the system does not boot, check the Recommended VirtualBox Version for Kicksecure ™ VirtualBox is in use.
KVM[edit]
1. Set the VM disks to read-only.
Follow these steps:
- Power off the machine.
- Set the hard disk to read-only in the virt-manager GUI before booting into live mode.
2. Launch live-mode.
Following reboot, a second boot entry called "VM Live Mode-mode" will be visible. Select it and then press Enter to boot the live system and use it as normal.
3. Optional: Revert the read-only change.
To boot into normal mode again, revert the change from step 1 and choose the normal boot option in the GRUB menu.
Alternative Configurations[edit]
Skip this section if the KVM Live-mode or Virtualbox Live-mode configuration steps above have already been completed.
Virtualbox and KVM:
VirtualBox only:
Footnotes[edit]
- ↑
Careful. If you remove the wrong drive, your VM will no longer boot. If you are worried, clone the VM first before proceeding.
- Power off the VM.
VirtualBox→click a VM→Settings→Storage→click on DVD device symbol→click on disk removal symbol- VirtualBox will ask
Are you sure you want to delete the optical drive?
You will not be able to insert any optical disks or ISO images or install the Guest Additions without it!
4.
click "Remove"https://forums.whonix.org/t/no-longer-add-virtual-dvd-drive-to-vm-by-default/9337
- ↑
Careful. If you remove the wrong drive, your VM will no longer boot. If you are worried, clone the VM first before proceeding.
- Power off the VM.
VirtualBox→click a VM→Settings→Storage→click on DVD device add symbol→click Leave Empty→click OK- Usual way to add DVD's to VirtualBox VMs can now be used such as
VirtualBox→click a VM→click on [Optical Drive]
At
Kicksecure we believe in freedom and trust. That's why we fully support Open Source and Freedom Software.
Kicksecure ™ is supported by Evolution Host DDoS Protected VPS.
ENCRYPTED SUPPORT LP,
2023