Important:

• Host firewall - still unfinished - still untested - https://github.com/Whonix/whonix-host-firewall
• tcp timestamps: install tcp-timestamps-disable (done: anon-host-additions depends on anon-shared-packages-dependencies which depends on tcp-timestamps-disable)
• icmp timestamps (done: blocked by https://github.com/Whonix/whonix-host-firewall)
• sdwdate / timesync (done: anon-host-additions depends on anon-shared-packages-dependencies which depends on sdwdate, timesync,etc.)

Bonus:

• corridor firewall feature, see this post

• AppArmor for VBox (whonix-host-virtualbox suggests apparmor-profile-virtualbox)
• AppArmor for KVM (Not required. libvirt comes with svirt.)

• ksm
  • https://github.com/dnaeon/ksm-init.d-debian
  • https://www.whonix.org/wiki/Dev/KVM#Kernel_Samepage_Merging_.28KSM.29
  • Not enabled by default as per https://www.whonix.org/forum/index.php/topic,605.0/topicseen.html

• Shared Folder Settings

• Backup of hidden service keys.

• Apply instructions from https://whonix.org/wiki/Advanced_Security_Guide#Network_Time_Synchronization (no longer needed thanks to https://github.com/Whonix/bootclockrandomization)
• create original snapshots of Virtual Machines (not for VirtualBox due to bug in VirtualBox)

If needed, we can split this ticket into separate ones.

Update:
Removed defunct ./whonix_host folder in meanwhile.

• https://github.com/Whonix/Whonix/blob/5404ab9f71f43b08c961f2b8f5b96974fb64b115/whonix_host/dev_clearnet
• https://github.com/Whonix/Whonix/blob/5404ab9f71f43b08c961f2b8f5b96974fb64b115/whonix_host/whonix_firewall