i once asked about using plain debian or arch and securing it myself. someone kindly told me to read the whonix documentation to figure out why that was a bad idea, so i did and started securing for my threat model.
i started with a fresh manual install (no archinstall) with full disk encryption and hardened kernel. i setup firewall, apparmor, and configured my desktop. i have virtualization (QEMU/KVM), and i plan on using docker for containerization (probably gonna switch to podman).
my darknet activity is confined to whonix vms until i can figure out how to safely route everything through tor myself. i also have tails usb on standby and passwords and pgp keys are stored on a separate encrypted usb.
my threat model is only USPS and local LE. i'm not a big player, just a small buyer, but i want to learn more about security. if there's other things you guys would recommend, let me know. like i said, i want to learn
Damn thats some overkill for someone just buying small amounts, but hey at least you should be safe on that side of he game. Make sure you apply the same effort on the physical receiving part as well
Nice setup, I would also recommend dnscrypt and never install proprietary software on the host. What DE do you use? Wayland-based are best for security.
just got dnscrypt setup. i embrace foss, docker is just what i'm used to. i haven't installed it yet. i would like to learn podman
and i use wayland. its been known that xorg has security flaws, so i avoid it
and i use wayland. its been known that xorg has security flaws, so i avoid it
You probably don't need to route everything over Tor if you're just buying off DNMs. Unless you plan on needing anonymous internet traffic other than your browser just use the Tor Browser. But if you did need to route everything over Tor, you can use the tor systemd service to start a local socks5 proxy service, then set whatever you use to configure your network, like network manager, to route everything through that socks proxy which will be localhost:9050. If you want extra protection set your firewall to reject all outgoing traffic except on 9050.
I don't advise you this, because it breaks the principle of compartmentalization and could add either deanonymizing traffic over the same circuit (like you log in to something), or just add trash traffic that's possibly fingerprinting in other ways.
I don't advise you this, because it breaks the principle of compartmentalization and could add either deanonymizing traffic over the same circuit (like you log in to something), or just add trash traffic that's possibly fingerprinting in other ways.
So what's your connection? I hope anonymous esim or public wifi if you're going through that kind of trouble
Looking good, your setup right now is really solid. I do not think podman is a necessity, it is very good as is. Did you harden the Whonix xml files?