There is currently no testers-only version of Whonix.

Warning: This is the testers-only version of Kicksecure ™ for VirtualBox. For the stable version, go to VirtualBox.

Please follow these steps to install Kicksecure ™ {{{flavor_case_sensitive}}}

1. Download Kicksecure ™ {{{flavor_case_sensitive}}} for Windows, MacOS and Linux

Download Kicksecure ™ {{{flavor_case_sensitive}}} (FREE!)

Optional: Verify the Kicksecure ™ Images cryptographically.

Version: 16.0.0.8

Digital signatures can increase security but this requires knowledge. Learn more about digital software signature verification.

 Download Kicksecure ™ {{{flavor_case_sensitive}}}
  
 OpenPGP Signature
  
 sha512
  
 sha512 OpenPGP
  
 sha512 Signify
  
 Verify images using this Signing Key

How to verify the Kicksecure ™ Images : Kicksecure ™ virtual machine images are cryptographically signed by Kicksecure ™ developer Patrick Schleizer using OpenPGP and signify.

Do you already how to perform digital software verification using an OpenPGP and/or signify key?

Yes: Acquire the Kicksecure ™ Signing Key and the Kicksecure ™ signatures straight away and proceed.
No: Consider the following instructions:

2. Install VirtualBox

Download and install.

Windows
macOS
Linux (Expand)

sha256 (Windows, macOS)

Choose your Linux distribution if listed below or "Linux host operating systems" for generic instructions if not listed here.

Linux host operating systems:

Hosts using a non-Debian operating system:

Install VirtualBox as per the normal mechanism for your Linux distribution. No special instructions for Kicksecure ™ are required. The installation of a recent VirtualBox host software is unspecific to Kicksecure ™. Consult the documentation of your Linux distribution.
Kicksecure ™ has has been tested with, expects VirtualBox version latest.
For example the outdated VirtualBox version 5.2.18 is incompatible.

General recommendations for users using Linux as a host operating system:

Linux kernel version:
- The recommended host Linux kernel version is the same version that Debian bullseye is using, see linux-image-amd64.
- Newer host Linux kernel versions are likely to break VirtualBox VMs in many ways since these are unsupported by VirtualBox. ^[1]
Host operating system: The recommended host Linux distributions are:
- preferebly the stable version of Kicksecure ™ 16, or
- Debian Linux version bullseye.

Ubuntu:

Ubuntu hosts:

Ubuntu bionic (18.04LTS) APT repository ships only VirtualBox version 5.2.18 and Kicksecure ™ will probably not work.

You might want to release-upgrade to Ubuntu hirsute (21.04) and install the virtualbox package from the hirsute-updates backports repository which provides at time of writing VirtualBox version 6.1.26.

See also above "Linux host operating systems".

Debian:

Debian host operating systems:

These instructions are for host operating systems running Debian bullseye, which is recommended.
Other Debian releases might work, but this is untested. In case of other Debian releases, see also above "Linux host operating systems".
To acquire the Recommended VirtualBox version tested with Kicksecure ™, package virtualbox should be installed from Debian fasttrack repository according to the following instructions. ^[2]

1. On the host.

Open a terminal.

2. Add Debian the fasttrack repository.

Update the package lists.

sudo apt update

Install the Debian fasttrack signing key.

sudo apt install fasttrack-archive-keyring

Add the Debian fasttrack repository.

echo 'deb https://fasttrack.debian.net/debian/ bullseye-fasttrack main contrib non-free' | sudo tee /etc/apt/sources.list.d/fasttrack.list

3. Update the package lists again. ^[3]

sudo apt update

4. Install VirtualBox and Linux kernel headers.

sudo apt install virtualbox linux-headers-$(dpkg --print-architecture)

5. Add your current user to group vboxusers. ^[4]

sudo adduser $(whoami) vboxusers

6. Done.

The procedure of installing the VirtualBox host software is complete.

Kicksecure ™:

Kicksecure ™ host operating systems:

1. On the host.

Open a terminal.

2. Update package lists.

sudo apt update

3. Install VirtualBox and Linux kernel headers.

sudo apt install virtualbox linux-headers-$(dpkg --print-architecture)

4. Add your current user to group vboxusers. ^[4]

sudo adduser $(whoami) vboxusers

6. Done.

The procedure of installing the VirtualBox host software is complete.

3. Import Kicksecure ™ into VirtualBox

For Kicksecure ™ VirtualBox import instructions, please press on expand on the right.

Start VirtualBox

Click on File then choose Import Appliance...

Navigate and select Kicksecure ™ image and press next

Do NOT change anything! Just click on Import

Then press Agree

Wait until Kicksecure ™ .ova has been imported

Now start both Kicksecure ™ and Kicksecure ™

Miscellaneous

There are also Video Tutorials.

If you still need help, please check the Support page.

For command line import instructions, see footnote. ^[5]

4. Start Kicksecure ™

Start VirtualBox → Double-click Kicksecure.

First time users and more[edit]

First time users information

default username: user
default password: changeme

Warning:

If you have no idea how Kicksecure ™ works, then read the Design and Goals, Kicksecure ™ Limitations and Tips on Remaining Safe pages to decide whether Kicksecure ™ is the right tool for you based on its limitations.

See Also

Documentation
Stay Tuned
In case of issues, see VirtualBox Troubleshooting.

For additional VirtualBox guides and information, please press on expand on the right.

Help Wanted

Work on the VirtualBox development task list.

Footnotes and Experimental Spectre / Meltdown Defenses → press Expand

VirtualBox Stable Version | VirtualBox Testers Only Version

Testers only! For more information please press on expand on the right.

These experimental Spectre/Meltdown defenses are related to issues outlined in Firmware Security and Updates. Due to the huge performance penalty and unclear security benefits of applying these changes, it may not be worth the effort. The reason is VirtualBox is still likely vulnerable, even after:

A host microcode upgrade.
A host kernel upgrade.
A VM kernel upgrade.
A "not vulnerable" result from spectre-meltdown-checker run on the host.
Installation of the latest VirtualBox version. ^[6]
All Spectre/Meltdown-related VirtualBox settings are tuned for better security as documented below.

To learn more, see: VirtualBox 5.2.18 vulnerable to spectre/meltdown despite microcode being installed and the associated VirtualBox forum discussion. ^[7] Users must patiently wait for VirtualBox developers to fix this bug.

On the host. ^[8] ^[9] ^[10] ^[11] ^[12] ^[13] ^[14]

VBoxManage modifyvm "Kicksecure" --ibpb-on-vm-entry on VBoxManage modifyvm "Kicksecure" --ibpb-on-vm-exit on VBoxManage modifyvm "Kicksecure" --l1d-flush-on-vm-entry on VBoxManage modifyvm "Kicksecure" --l1d-flush-on-sched on VBoxManage modifyvm "Kicksecure" --spec-ctrl on VBoxManage modifyvm "Kicksecure" --nestedpaging off VBoxManage modifyvm "Kicksecure" --mds-clear-on-vm-entry on VBoxManage modifyvm "Kicksecure" --mds-clear-on-sched on

These steps must be repeated for every VirtualBox VM, including multiple and custom VMs.

The above instructions only apply to the default VM names Kicksecure ™ and Kicksecure ™. Therefore, if Multiple Kicksecure ™s and/or Multiple Kicksecure ™s are configured, then repeat these instructions using the relevant name/s.

Footnotes[edit]

↑ https://www.virtualbox.org/ticket/17055#comment:3
↑ This is non-ideal but required since VirtualBox in unavailable in official Debian bullseye repository and difficult to install due to VirtualBox Installation Challenges. Alternatively you could install VirtualBox from the Oracle (virtualbox.org) Repository, but this comes with different risks. VirtualBox might be updated by VirtualBox developers before being tested with Kicksecure ™ which could then lead to issues. (Described in footnote here.)
↑ This is to acquire the Debian fasttrack repository package sources.
↑ ^4.0 ^4.1 Optional: See: https://www.virtualbox.org/manual/ch02.html#install-linux-vboxusers Also spams ~/.config/VirtualBox/VBoxSVC.log log if not done.
↑ On the Linux platform.
1. Read License Agreement:
vboxmanage import Kicksecure-XFCE-16.0.5.3.ova --vsys 0 --eula show --vsys 1 --eula show
2. Import Kicksecure and Kicksecure ™.
vboxmanage import Kicksecure-XFCE-16.0.5.3.ova --vsys 0 --eula accept --vsys 1 --eula accept
↑ VirtualBox version 5.2.18 or above is required since only that version comes with Spectre/Meltdown defenses. See https://forums.whonix.org/t/whonix-vulerable-due-to-missing-processor-microcode-packages/5739/22.
↑ Also see the following forum discussion: vulerable due to missing processor microcode packages? spectre / meltdown / retpoline / L1 Terminal Fault (L1TF)
↑

--ibpb-on-vm-[enter|exit] on|off: Enables flushing of the indirect branch prediction buffers on every VM enter or exit respectively. This could be enabled by users overly worried about possible spectre attacks by the VM. Please note that these options may have sever impact on performance.
https://www.virtualbox.org/manual/ch08.html

There is a mistake in the VirtualBox manual stating enter which does not work. It is actually entry.
↑ https://www.virtualbox.org/manual/ch08.html

--l1d-flush-on-vm-enter on|off: Enables flushing of the level 1 data cache on VM enter. See Section 13.4.1, “CVE-2018-3646”.
↑

--l1d-flush-on-sched on|off: Enables flushing of the level 1 data cache on scheduling EMT for guest execution. See Section 13.4.1, “CVE-2018-3646”.
https://www.virtualbox.org/manual/ch08.html
↑ https://www.virtualbox.org/manual/ch13.html#sec-rec-cve-2018-3646

For users not concerned by this security issue, the default mitigation can be disabled using

VBoxManage modifyvm name --l1d-flush-on-sched off

Since we want to enable the security feature we set --l1d-flush-on-sched on.
↑

--spec-ctrl on|off: This setting enables/disables exposing speculation control interfaces to the guest, provided they are available on the host. Depending on the host CPU and workload, enabling speculation control may significantly reduce performance.
https://www.virtualbox.org/manual/ch08.html
↑ According to this VirtualBox ticket --spec-ctrl should be set to on.
↑

--nestedpaging on|off: If hardware virtualization is enabled, this additional setting enables or disables the use of the nested paging feature in the processor of your host system; see Section 10.7, “Nested paging and VPIDs” and Section 13.4.1, “CVE-2018-3646”.

Unfinished: This wiki is a work in progress. Please do not report broken links until this notice is removed, use Search Engines First and contribute improving this wiki.

Kicksecure ™ A secure by default operating system with the latest security research in place.

Donate

FREE · PLUS · PREMIUM Support

At Kicksecure we believe in freedom and trust. That's why we fully support Open Source and Freedom Software. Learn more.

Kicksecure ™ is supported by Evolution Host DDoS Protected VPS.

Kicksecure ™ is a secure by default operating system with the latest security research in place.

The personal opinions of moderators or contributors to the Kicksecure ™ project do not represent the project as a whole. By using this website, you acknowledge you have read, understood, and agree to be bound by these these agreements: Terms of Service , Privacy Policy , Cookie Policy , E-Sign Consent , DMCA , Imprint Kicksecure

ENCRYPTED SUPPORT LP, 2022

Kicksecure ™ is Hardened by Kicksecure ™

[1] ttps://www.virtualbox.org/ticket/17055#comment:3

[2] This is non-ideal but required since VirtualBox in unavailable in official Debian bullseye repository and difficult to install due to VirtualBox Installation Challenges. Alternatively you could install VirtualBox from the Oracle (virtualbox.org) Repository, but this comes with different risks. VirtualBox might be updated by VirtualBox developers before being tested with Kicksecure ™ which could then lead to issues. (Described in footnote here.)

[3] This is to acquire the Debian fasttrack repository package sources.

[vboxusersgroupadd-4] 4.0 ^4.1 Optional: See: https://www.virtualbox.org/manual/ch02.html#install-linux-vboxusers Also spams ~/.config/VirtualBox/VBoxSVC.log log if not done.

[5] On the Linux platform.
1. Read License Agreement:
vboxmanage import Kicksecure-XFCE-16.0.5.3.ova --vsys 0 --eula show --vsys 1 --eula show
2. Import Kicksecure and Kicksecure ™.
vboxmanage import Kicksecure-XFCE-16.0.5.3.ova --vsys 0 --eula accept --vsys 1 --eula accept

[6] VirtualBox version 5.2.18 or above is required since only that version comes with Spectre/Meltdown defenses. See https://forums.whonix.org/t/whonix-vulerable-due-to-missing-processor-microcode-packages/5739/22.

[7] Also see the following forum discussion: vulerable due to missing processor microcode packages? spectre / meltdown / retpoline / L1 Terminal Fault (L1TF)

[8] 

--ibpb-on-vm-[enter|exit] on|off: Enables flushing of the indirect branch prediction buffers on every VM enter or exit respectively. This could be enabled by users overly worried about possible spectre attacks by the VM. Please note that these options may have sever impact on performance.
https://www.virtualbox.org/manual/ch08.html

There is a mistake in the VirtualBox manual stating enter which does not work. It is actually entry.

[9] ttps://www.virtualbox.org/manual/ch08.html

--l1d-flush-on-vm-enter on|off: Enables flushing of the level 1 data cache on VM enter. See Section 13.4.1, “CVE-2018-3646”.

[10] 

--l1d-flush-on-sched on|off: Enables flushing of the level 1 data cache on scheduling EMT for guest execution. See Section 13.4.1, “CVE-2018-3646”.
https://www.virtualbox.org/manual/ch08.html

[11] ttps://www.virtualbox.org/manual/ch13.html#sec-rec-cve-2018-3646

For users not concerned by this security issue, the default mitigation can be disabled using

VBoxManage modifyvm name --l1d-flush-on-sched off

Since we want to enable the security feature we set --l1d-flush-on-sched on.

[12] 

--spec-ctrl on|off: This setting enables/disables exposing speculation control interfaces to the guest, provided they are available on the host. Depending on the host CPU and workload, enabling speculation control may significantly reduce performance.
https://www.virtualbox.org/manual/ch08.html

[13] According to this VirtualBox ticket --spec-ctrl should be set to on.

[14] 

--nestedpaging on|off: If hardware virtualization is enabled, this additional setting enables or disables the use of the nested paging feature in the processor of your host system; see Section 10.7, “Nested paging and VPIDs” and Section 13.4.1, “CVE-2018-3646”.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]