Kicksecure ™ for VirtualBox with CLI
This is a pre-release. (What does that mean?)
Kicksecure ™ with CLI is a version suited for advanced users -- those who want Kicksecure ™ without a GUI. Everyone else should install the user-friendly Kicksecure ™ VirtualBox with XFCE.
1. Download Kicksecure ™ CLI for Windows
, MacOS
and Linux
FREE
By downloading, you acknowledge that you have read, understood and agreed to our Terms of Service and License Agreement.
Version: 16.0.4.2
Type | Connection | Link | Download Security without Verification |
Download Security with Verification |
![]() |
![]() |
Medium | High [1] | |
![]() |
![]() |
Medium | High | |
![]() |
![]() |
- | - | |
![]() |
![]() |
- | - | |
![]() |
Verify images using this Signing Key |
Verify the Kicksecure ™ Images Template:Verify the virtual machine images
2. Install VirtualBox
Recommended VirtualBox version: {{{virtualbox_version}}}
- Windows
, Mac
: Download VirtualBox
and install.
- Linux
: please press expand on the right side.
Recommendations for Linux users:
- The recommended host Linux kernel version is the same version that Debian
bullseye
is using, seelinux-image-amd64
.
- Linux users only: use the recommended Linux distribution as a host for Kicksecure ™ VirtualBox is Debian Linux
version
bullseye
.
Hosts using a non-Debian OS:
Install VirtualBox as per the normal mechanism for your Linux distribution. Kicksecure ™ has has been tested with, expects VirtualBox version latest
For example VirtualBox version 5.2.18
has been reported to not be compatible.
Ubuntu hosts:
Ubuntu bionic
(18.04LTS
) APT repository ships only VirtualBox version 5.2.18
and Kicksecure ™ will probably not work.
You might want to release-upgrade to Ubuntu hirsute
(21.04
) and install the virtualbox
package from the hirsute-updates
backports repository which provides at time of writing VirtualBox version 6.1.26
.
Debian hosts:
Notes:
- These instructions are for host operating systems running Debian
bullseye
, which is recommended. - Other Debian releases might work, but this is untested.
- To acquire the Recommended VirtualBox version tested with Kicksecure ™, package
virtualbox
should be installed from Debianfasttrack
repositoryaccording to the following instructions. [2]
1. On the host.
Open a terminal.
2. Add Debian the fasttrack
repository.
Update the package lists.
Install the Debian fasttrack
signing key.
Add the Debian fasttrack
repository.
3. Update the package lists again. [3]
4. Install VirtualBox and Linux kernel headers.
5. Add your current user to group vboxusers
. [4]
6. Done.
The procedure of installing the VirtualBox host software is complete.
3. Import Kicksecure ™ into VirtualBox
For Kicksecure ™ VirtualBox import instructions, please press on expand on the right.
Click on File then choose Import Appliance...
Navigate and select Kicksecure ™ image and press next
Do NOT change anything! Just click on Import
Wait until Kicksecure ™ .ova
has been imported
Now start both Kicksecure ™ and Kicksecure ™
Miscellaneous
There are also Video Tutorials.
If you still need help, please check the Support page.
For command line import instructions, see footnote. [5]
4. Start Kicksecure ™
Starting Kicksecure ™ is simple.
Start VirtualBox
→ Double-click the Kicksecure ™ and Kicksecure ™
.
First time user?
If you have no idea how Kicksecure ™ works, then read the Design and Goals, Kicksecure ™ Limitations and Tips on Remaining Safe pages to decide whether Kicksecure ™ is the right tool for you based on its limitations.
See Also
- Documentation
- Stay Tuned
- In case of issues, see VirtualBox Troubleshooting.
For additional VirtualBox guides and information, please press on expand on the right.
Footnotes and Experimental Spectre / Meltdown Defenses
Please press on expand on the right.
VirtualBox Stable Version | VirtualBox Testers Only Version
Testers only! For more information please press on expand on the right.
These experimental Spectre/Meltdown defenses are related to issues outlined in Firmware Security and Updates. Due to the huge performance penalty and unclear security benefits of applying these changes, it may not be worth the effort. The reason is VirtualBox is still likely vulnerable, even after:
- A host microcode upgrade.
- A host kernel upgrade.
- A VM kernel upgrade.
- A "not vulnerable" result from spectre-meltdown-checker run on the host.
- Installation of the latest VirtualBox version. [6]
- All Spectre/Meltdown-related VirtualBox settings are tuned for better security as documented below.
To learn more, see: VirtualBox 5.2.18 vulnerable to spectre/meltdown despite microcode being installed and the associated VirtualBox forum discussion
. [7] Users must patiently wait for VirtualBox developers to fix this bug.
On the host. [8] [9] [10] [11] [12] [13] [14]
VBoxManage modifyvm "Kicksecure" --ibpb-on-vm-entry o VBoxManage modifyvm "Kicksecure" --ibpb-on-vm-exit on VBoxManage modifyvm "Kicksecure" --l1d-flush-on-vm-entry on VBoxManage modifyvm "Kicksecure" --l1d-flush-on-sched on VBoxManage modifyvm "Kicksecure" --spec-ctrl on VBoxManage modifyvm "Kicksecure" --nestedpaging off VBoxManage modifyvm "Kicksecure" --mds-clear-on-vm-entry on VBoxManage modifyvm "Kicksecure" --mds-clear-on-sched on
VBoxManage modifyvm "Kicksecure" --ibpb-on-vm-entry on VBoxManage modifyvm "Kicksecure" --ibpb-on-vm-exit on VBoxManage modifyvm "Kicksecure" --l1d-flush-on-vm-entry on VBoxManage modifyvm "Kicksecure" --l1d-flush-on-sched on VBoxManage modifyvm "Kicksecure" --spec-ctrl on VBoxManage modifyvm "Kicksecure" --nestedpaging off VBoxManage modifyvm "Kicksecure" --mds-clear-on-vm-entry on VBoxManage modifyvm "Kicksecure" --mds-clear-on-sched on
These steps must be repeated for every Whonix or non-Whonix VirtualBox VM, including multiple and custom VMs.
The above instructions only apply to the default VM names Kicksecure ™ and Kicksecure ™. Therefore, if Multiple Kicksecure ™s and/or Multiple Kicksecure ™s are configured, then repeat these instructions using the relevant name/s.
Footnotes[edit]
- ↑ It does not matter if the bulk download is done over an insecure channel if software signature verification is used at the end.
- ↑
This is non-ideal but required since VirtualBox in unavailable in official Debian
bullseye
repository and difficult to install due to VirtualBox Installation Challenges. Alternatively you could install VirtualBox from the Oracle (virtualbox.org) Repository, but this comes with different risks. VirtualBox might be updated by VirtualBox developers before being tested with Kicksecure ™ which could then lead to issues. (Described in footnote here.) - ↑
This is to acquire the Debian
fasttrack
repository package sources. - ↑
Optional: See: https://www.virtualbox.org/manual/ch02.html#install-linux-vboxusers
Also spams
~/.config/VirtualBox/VBoxSVC.log
log if not done. - ↑
On the Linux platform.
1. Read License Agreement:vboxmanage import Kicksecure-XFCE-16.0.4.2.ova --vsys 0 --eula show --vsys 1 --eula show2. Import Kicksecure ™ and Kicksecure ™.vboxmanage import Kicksecure-XFCE-16.0.4.2.ova --vsys 0 --eula accept --vsys 1 --eula accept - ↑
VirtualBox version
5.2.18
or above is required since only that version comes with Spectre/Meltdown defenses. See https://forums.whonix.org/t/whonix-vulerable-due-to-missing-processor-microcode-packages/5739/22.
- ↑ Also see the following Whonix forum discussion: Whonix vulerable due to missing processor microcode packages? spectre / meltdown / retpoline / L1 Terminal Fault (L1TF)
- ↑
--ibpb-on-vm-[enter|exit] on|off: Enables flushing of the indirect branch prediction buffers on every VM enter or exit respectively. This could be enabled by users overly worried about possible spectre attacks by the VM. Please note that these options may have sever impact on performance.
https://www.virtualbox.org/manual/ch08.htmlThere is a mistake in the VirtualBox manual stating
enter
which does not work. It is actuallyentry
. - ↑
https://www.virtualbox.org/manual/ch08.html
--l1d-flush-on-vm-enter on|off: Enables flushing of the level 1 data cache on VM enter. See Section 13.4.1, “CVE-2018-3646”.
- ↑
--l1d-flush-on-sched on|off: Enables flushing of the level 1 data cache on scheduling EMT for guest execution. See Section 13.4.1, “CVE-2018-3646
”.
https://www.virtualbox.org/manual/ch08.html - ↑
https://www.virtualbox.org/manual/ch13.html#sec-rec-cve-2018-3646
For users not concerned by this security issue, the default mitigation can be disabled using
VBoxManage modifyvm name --l1d-flush-on-sched offSince we want to enable the security feature we set
--l1d-flush-on-sched on
. - ↑
--spec-ctrl on|off: This setting enables/disables exposing speculation control interfaces to the guest, provided they are available on the host. Depending on the host CPU and workload, enabling speculation control may significantly reduce performance.
https://www.virtualbox.org/manual/ch08.html - ↑
According to this VirtualBox ticket
--spec-ctrl
should be set toon
. - ↑
--nestedpaging on|off: If hardware virtualization is enabled, this additional setting enables or disables the use of the nested paging feature in the processor of your host system; see Section 10.7, “Nested paging and VPIDs” and Section 13.4.1, “CVE-2018-3646”.
Unfinished: This wiki is a work in progress. Please do not report broken links until this notice is removed, use Search Engines First and contribute improving this wiki.