1

Is it okay to use the whonix gateway to host an onion?

And simply point the hidden service to a debian workstation like "10.152.152.17 12345"? Generally it seems best not to modify any of the whonix preconfigured settings. So I'm not sure if using the gateway to host a web server is good or bad for security. For example, if the web server in the debian workstation gets compromised, is it better that I'm using whonix or would that make it easier for an attacker to pivot through my network? Or does it not make a difference at all?

  • The gateway is sacrosanct, it should have a minimal attack surface. It is the main security advantage of Whonix. Adding a webserver to it would potentially allow an attacker who compromised the workstation, to try to exploit the webserver and attack the gateway to break the isolation it provides. I'm not an expert on Whonix, infact I've never run Whonix but it will definitely make you less secure, and would also likely require making changes to the iptables rules of the gateway which might have further unintended consequences. – cacahuatl Sep 2 '16 at 3:39
1

No, do not use the gateway to host the webserver.

Use the workstation to host it. In the torrc file on the gateway, you will point the server:port on the workstation. Instructions can be found on the whonix wiki here: https://www.whonix.org/wiki/Hidden_Services

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.