Syllabus / Whonix Course

1Threat models first

Decide what you are protecting before you touch a tool. Most bad setups are good tools aimed at the wrong problem.

1.1 What you are protecting, and from whom Assets, adversaries, and what happens if you lose.
1.2 Privacy, anonymity, security Three different problems that people treat as one.
1.3 What actually leaks IP addresses, DNS, metadata, fingerprints, and habits.
1.4 Writing your threat model A one-page document you will revisit at the end of the course. [lab]

Enough of the protocol to reason about what Whonix does and what it cannot do.

2.1 Circuits and relays What the entry, middle, and exit relay each know.
2.2 Exit relays and unencrypted traffic Where your traffic leaves Tor, and who can read it there.
2.3 Onion services Connections that never leave the Tor network.
2.4 What Tor does not do The failure modes the rest of the course is built around.

Understand the design well enough to predict how it behaves, rather than following steps.

3.1 Gateway and Workstation Two virtual machines, one isolated network between them. [lab]
3.2 Why isolation, not just configuration The difference between asking an app not to leak and making sure it can't.
3.3 The user and sysmaint sessions Why sudo says permission denied, and why that is intended.
3.4 Choosing a platform VirtualBox, KVM, or Qubes, and how to decide.

Get a working lab and prove to yourself that it behaves the way you think it does.

4.1 Preparing the host Hardware virtualization, memory, and disk.
4.2 Downloading and verifying images Checking a signature, and knowing what the check does and doesn't tell you. [lab]
4.3 First boot Bringing up the Gateway and connecting to Tor. [lab]
4.4 Connecting from restrictive networks Bridges and pluggable transports, for networks where a direct Tor connection fails.
4.5 Updates and snapshots A maintenance routine you will actually keep. [lab]

Use the system for real tasks without quietly undoing its protections.

5.1 Tor Browser on the Workstation Why the defaults matter, and why customising makes you stand out.
5.2 Installing software Adding tools without weakening the setup.
5.3 Stream isolation Keeping different applications off the same circuit. [lab]
5.4 Moving files in and out The boundary between host and guest is where mistakes happen. [lab]
5.5 Time and sdwdate Clocks are an identifier too.

Keep separate activities separate, including when you are tired and in a hurry.

6.1 Multiple Workstations One Gateway, several isolated work environments. [lab]
6.2 Qubes-Whonix and disposables Throwaway environments for untrusted material.
6.3 Keeping identities apart Most identity links come from behaviour rather than from network failures.
6.4 Writing your own procedures Checklists for the steps you can't afford to get wrong. [lab]

Run a small service, such as a contact point for sources, on infrastructure you control.

7.1 Hosting an onion service The Tor configuration lives on the Gateway, and the service runs on the Workstation. [lab]
7.2 Client authorization and keys Restricting who can reach the service, and protecting its identity.
7.3 Keeping a service running The maintenance that is easy to forget.

Test the lab you built, and return to the threat model from module 1.

8.1 Auditing your lab Check what your setup does against what you expect it to do. [lab]
8.2 How setups fail in practice A tour of the common mistakes, most of them not technical.
8.3 Final review Update your threat model and document your configuration. [lab]