https://wiki.nftables.org/wiki-nftables/index.php/Atomic_rule_replacement

https://wiki.nftables.org/wiki-nftables/index.php/Scripting

Some progress.

In other words, iptabels is already symlinked to iptabels-nft anyhow. Therefore Whonix is already using iptabels-nft.

• https://unix.stackexchange.com/questions/722007/translate-firewall-rule-from-iptables-to-nftables
• https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables

related:
https://forums.whonix.org/t/tails-features-ideas/2611

Fixed link:
https://github.com/Whonix/whonix-firewall/commit/414c2105149e02dcff82303e4c5b2dcd60ebbd29

https://forums.whonix.org/t/whonix-linux-installer-development-discussion/15917/20

Due to phabricator being deprecated upstream, all tickets need to me migrated. Therefore closing here.

https://forums.whonix.org/t/torbirdy-replacement/8782

This is implemented in /usr/libexec/systemcheck/check_dpkg.bsh for a long time already.

Due to https://www.whonix.org/wiki/Reporting_Bugs#Transition_to_Discourse_Forums all tickets need to be migrated to forums. Please re-open in forums if this still still relevant.

This will be done when doing T927.

And we also port to dracut which also does early sysctl loading.
Adding tons of sysctl to an already very long kernel command line (do we got the world record already :) seems excessive.
Since nobody is making the argument anymore, rejecting this ticket.

Now tracked here:
https://forums.whonix.org/t/coyim-in-whonix-development-discussion/5901

No longer an issue in Whonix 16.

Still works for me, still not reproducible. Old ticket. Therefore closing. Please re-report in the new issue tracker (and link to this old ticket) should this still be an issue.

whonixcheck was renamed to systemcheck and is now functional in Kicksecure.

Not a good idea nowadays due to prolonged DDoS attack on the Tor network. References:

Tracked in https://forums.whonix.org/t/cwtch-messaging/5353/ but could use some new forum tag for things which aren't actionable (not in packages.debian.org) that we want to monitor every now and then over the various releases maybe.

This is for whonix.org server security?

Done for a long time.

test

test

https://www.kicksecure.com/wiki/Dev/sdwdate#chrony_as_a_replacement_for_sclockadj

Is this still reuqired since we also have early sysctl loading during initramfs?

Funding available. Anyone up to implement this?

No longer using this extension. Alternatives here:
https://www.whonix.org/wiki/Offline_Documentation

No mailing list at the moment. Deprecating this issue tracker. Can be re-considered in the future.

rsync over TLS or even onion is implemented for a long time already and documented here:
https://www.whonix.org/wiki/Hosting_a_Mirror

This was done a long time ago.

Not possible because of above issue.

https://forums.whonix.org/t/disk-usb-automount-in-kicksecure/8728/31

Cannot reproduce anymore in Whonix for VirtualBox.

In T509#20232, @ak88 wrote:

Any updates on this?

Any updates on this?

migrated to https://forums.whonix.org/t/mediawiki-css-fixes/11874

migrated to https://forums.whonix.org/t/mediawiki-css-fixes/11874

In T993#20220, @Patrick wrote:

I don't see what else can be done here. This statement is limited to only what was said in this ticket.

I don't see what else can be done here. This statement is limited to only what was said in this ticket.

Btw this issue tracker is being phased out:
https://www.whonix.org/wiki/Reporting_Bugs#Issue_Tracker

I am not sure sdwdate-gui would be a strong enough notification if networking was actually blocked if sdwdate did not succeed yet.

This was implemented. Now using python3 requests.

No longer required. Was implemented through te_pe_tb_check enhancements.

https://gitlab.com/whonix/qubes-whonix/-/commit/53ff72ab6ce59cb2c98401fd701ae782ca100e37

I've found why sudo asked for password, it wasn't related to security-misc script mentioned earlier. And should be fixed in newer qubes-core-agent package.

In T1001#20201, @Patrick wrote:

/usr/lib/qubes-whonix/init/torified-updates-proxy-check is currently only started by /lib/systemd/system/qubes-whonix-torified-updates-proxy-check.service.

Wondering why this is happening. When root uses sudo, pam shouldn't even be involved.

/usr/lib/qubes-whonix/init/torified-updates-proxy-check is currently only started by /lib/systemd/system/qubes-whonix-torified-updates-proxy-check.service.

documented here:
https://www.whonix.org/wiki/Whonixcheck_Hardening#Prevent_Downloading_Whonix_.E2.84.A2_News_and_Whonix_.E2.84.A2_User_Census_Counting

Looks all good and quite in Whonix 15.0.1.5.1.

We don't use this tracker for new feature requests anymore either as per:
https://www.whonix.org/wiki/Reporting_Bugs

It is important to understand, that systemD is actually much more than simply an init system:

Shipping kloak in Whonix stable for a few releases already.

After running a bunch of tcp ping tests, the conclusion is this attack
is not really effective against TCP like ICMP. The latency is much lower
for TCP pings and though it slightly decreases with cpu stress it is not
consistent. Reloading pages in TBB with cpu stress
on/off does not impact latency readings while doing so with tc
attached has massive latency foot prints - implying it will ironically make such attacks much easier in addition to degrading performance.