What to do when Whonix asks for {password for sysmaint}?

User Support
, ,
1

Hallow all.
When installing software on Whonix, you will be asked for {password for sysmaint}.But I haven’t set a password.
When I looked it up, I found out that "I have to either use the sysmaint user or root, or enable unrestricted admin mode. "I found out.
I want to set it to “unrestricted admin mode” but I don’t know how to do it. I also don’t know what kind of negative effects will occur if I set it to that mode. Please tell them.

2

http://www.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion/wiki/Sysmaint#Kicksecure_for_Qubes
http://www.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion/wiki/Unrestricted_admin_mode#Kicksecure_for_Qubes

2 Likes
3

Actually, I was reading the article before setting up this thread, but I didn’t really understand it. Let me ask you a few questions about how to install software using Kicksecure and how to install software with Uninstalling user-sysmaint-split. First of all, I actually read the article before setting up this thread, but I didn’t really understand. I’m going to try as much as I can for the time being. Also, let me ask you a few questions about how to install software using Kicksecure.
(1) Is Kicksecure installed on Qubes from the beginning? Or do you have to install it first?
(2) What does {service} mean? Do you mean the name of the cube?
(3) I haven’t set a password at this stage of {type sudo systemctl start service-name.service}, but isn’t it asked for a password when installing the software?
(4) What was mentioned in the article but I didn’t understand well, how do I use the installation command? Can {sudo apt} be used? Or { user-sysmaint-split}?

4

Whonix is based on Kicksecure and available from the installer

I think the other questions are not related to Qubes OS?

5

Kicksecure template is not included in the Qubes OS installation image, but you can install it later using Qubes Template Manager in dom0.

You’re looking at the wrong section of the guide - “Running services in sysmaint sessions”.
I’ve linked you to the specific “Usage” section. Press on the buttons there “Kicksecure for Qubes” → “Qubes OS 4.2”, If you have Qubes OS 4.2, then you’ll see this instruction:

In Qubes OS R4.2 and earlier: Kicksecure for Qubes cannot be booted into sysmaint mode. However, user-sysmaint-split is useful in Qubes VMs too because it makes SUID privilege escalation tools (sudo, su, pkexec) inaccessible for account user. You can access the root account by opening a Qubes Root Console.

You can install softawre in the root console using apt install packagename command.

1 Like
6

Thank you both. Especially MellowPoison Thank you for answering every detail. I tried to sort it out a little from the information you answered. Should I follow these steps?

(1) Type {qvm-template --enablerepo qubes-templates-community-testing install kicksecure-17} in Qubes Template Manager in dom0. (I looked up the command myself)Kicksecure for Qubes
(2) Type {qvm-console-dispvm vm-name} or {qvm-run -u root vm-name xfce4-terminal} in the Xfce Terminal of dom0. This {vm-name} would be {whonix-17} for example, whonix-17.
(3) Type {apt install packagename} into the window that appears by the command (2).

If this procedure seems to be okay, I will try it soon. Also, the command I was taught to type in step (2) was {qvm-run -u sysmaint templatename xtern}, but can I use this? This command worked in previous versions.
The password was written at the top of the article as {Passwordless login}, and I should have looked at it more carefully.

7

Yes.
But it should be whonix-workstation-17 or whonix-gateway-17, not whonix-17.

Follow the official documentation.

1 Like
8

But it should be whonix-workstation-17 or whonix-gateway-17, not whonix-17.

yes, this is right.

Follow the official documentation.

OK, I will try this way. thank you your advice!