Host OS Hardening (Debian -> Kicksecure)
Now that we're in our host OS, let's harden it by turning it into a Kicksecure distro:
su -
apt update ; apt full-upgrade ; apt install --no-install-recommends sudo adduser curl apt-transport-tor tor torsocks
/usr/sbin/addgroup --system console
/usr/sbin/adduser nothing console #replace nothing with your username
/usr/sbin/adduser nothing sudo #replace nothing with your username
reboot now
After rebooting, install kicksecure like so: (beware it must be done as the user mentionned above. in this case user is nothing:
nothing@debian:~$ sudo apt update -y ; sudo apt full-upgrade -y
Then we download the kicksecure keyring via tor:
nothing@debian:~$ sudo torsocks curl --output /usr/share/keyrings/derivative.asc --url http://www.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion/keys/derivative.asc
nothing@debian:~$ echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list
nothing@debian:~$ sudo apt update -y
Hit:1 http://security.debian.org/debian-security bookworm-security InRelease
Hit:2 http://deb.debian.org/debian bookworm InRelease
Hit:3 http://deb.debian.org/debian bookworm-updates InRelease
Get:4 tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion bookworm InRelease [39.6 kB]
Get:5 tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion bookworm/main amd64 Packages [34.3 kB]
Get:6 tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion bookworm/contrib amd64 Packages [506 B]
Get:7 tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion bookworm/non-free amd64 Packages [896 B]
Fetched 75.3 kB in 31s (2,419 B/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up to date.
nothing@debian:~$ sudo apt full-upgrade -y
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
sudo apt install --no-install-recommends kicksecure-cli-host -y
#tor connection may crash sometimes, so just relaunch that command again if it fails
Then we do the Post-upgrade steps:
sudo mv /etc/apt/sources.list ~/
sudo touch /etc/apt/sources.list
sudo reboot now
Then as you reboot you'll see that grub shows that it's now kicksecure instead of debian:
Next, we make sure that unattended upgrades are activated so that minor package updates are automatically carried out by the system.
nothing@debian:~$ sudo apt install unattended-upgrades apt-listchanges -y
nothing@debian:~$ sudo dpkg-reconfigure -plow unattended-upgrades
Next we're going to make sure that the ram gets overwritten upon shutdowns to prevent cold boot attacks.
nothing@debian:~$ sudo apt install --no-install-recommends ram-wipe
If you are testing from a VM, you need to do the following:
nothing@debian:~$ echo 'GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT wiperam=force"' | sudo tee -a /etc/default/grub.d/50_user.cfg
GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT wiperam=force"
nothing@debian:~$ sudo update-grub
Generating grub configuration file ...
Found background image: .background_cache.png
Found linux image: /boot/vmlinuz-6.1.0-17-amd64
Found initrd image: /boot/initrd.img-6.1.0-17-amd64
Found linux image: /boot/vmlinuz-6.1.0-15-amd64
Found initrd image: /boot/initrd.img-6.1.0-15-amd64
Warning: os-prober will not be executed to detect other bootable partitions.
Systems on them will not be added to the GRUB boot configuration.
Check GRUB_DISABLE_OS_PROBER documentation entry.
done
Then you can test if it's working by rebooting and checking the shutdown output logs.Next, we're going to trim out what we don't need from our Host OS. First and foremost, let's get rid of all the logs (both system and kernel logs) on the system. We first make sure that logs are cleared upon startup like so:
root@debian:~# cat startup.sh
#!/bin/bash
sudo rm -rf /var/log
sudo rm -rf /dev/shm/*
sudo ln -s /dev/shm /var/log
sudo dmesg -c
sudo dmesg -n 1
sudo dmesg -c
#also uncomment the kernel.printk line in /etc/sysctl.conf to avoid the kernel from printing out errors
root@debian:~# chmod +x startup.sh
root@debian:~# vim /etc/sysctl.conf
root@debian:~# cat /etc/sysctl.conf | grep printk
kernel.printk = 3 4 1 3
root@debian:~# vim /etc/systemd/system/startup.service
root@debian:~# cat /etc/systemd/system/startup.service
[Unit]
Description=Clearing logs at startup
Wants=network.target
After=network-online.target
[Service]
Type=oneshot
ExecStart=/root/startup.sh
TimeoutStartSec=0
[Install]
WantedBy=shutdown.target
root@debian:~# systemctl daemon-reload
root@debian:~# systemctl enable startup
Created symlink /etc/systemd/system/shutdown.target.wants/startup.service → /etc/systemd/system/startup.service.
Then we make sure that logs are being cleared out minutely:
root@debian:~# cat removelogs.sh
#!/bin/bash
rm -rf /dev/shm/*
rm -rf /var/log/*
dmesg -c
root@debian:~# chmod +x removelogs.sh
root@debian:~# crontab -e
Then we make sure that logs are cleared out upon shutdown, along with VMs shutdowns if there are any, veracrypt volumes closing, and log cleanups:
root@debian:~# vim shutdown.sh
root@debian:~# cat shutdown.sh
#!/bin/bash
#remove VMs
sudo virsh -c qemu:///system destroy Whonix-Gateway
sudo virsh -c qemu:///system destroy Whonix-Workstation
sudo virsh -c qemu:///system undefine Whonix-Gateway
sudo virsh -c qemu:///system undefine Whonix-Workstation
sudo virsh -c qemu:///system net-destroy Whonix-External
sudo virsh -c qemu:///system net-destroy Whonix-Internal
sudo virsh -c qemu:///system net-undefine Whonix-External
sudo virsh -c qemu:///system net-undefine Whonix-External
#then unmount veracrypt volumes
sudo veracrypt -d -f
# then cleanup logs
sudo rm -rf /dev/shm/*
sudo rm -rf /var/log/*
sudo dmesg -c
root@debian:~# chmod +x shutdown.sh
root@debian:~# vim /etc/systemd/system/shutdown.service
root@debian:~# cat /etc/systemd/system/shutdown.service
[Unit]
Description=Shutdown Anti forensics
DefaultDependencies=no
Before=shutdown.target reboot.target halt.target
[Service]
Type=oneshot
ExecStart=/root/shutdown.sh
TimeoutStartSec=0
[Install]
WantedBy=shutdown.target reboot.target halt.target
root@debian:~# systemctl daemon-reload
root@debian:~# systemctl enable shutdown
Created symlink /etc/systemd/system/shutdown.target.wants/shutdown.service → /etc/systemd/system/shutdown.service.
Created symlink /etc/systemd/system/reboot.target.wants/shutdown.service → /etc/systemd/system/shutdown.service.
Created symlink /etc/systemd/system/halt.target.wants/shutdown.service → /etc/systemd/system/shutdown.service.
Then you can reboot to see that all logs are removed as intended:
sudo reboot now
root@debian:~# ls -lash /var | grep log
0 lrwxrwxrwx 1 root root 8 Jan 30 14:13 log -> /dev/shm
root@debian:~# tail -f /var/log/*.log
tail: cannot open '/var/log/*.log' for reading: No such file or directory
tail: no files remaining
root@debian:~# tail -f /dev/shm/*.log
tail: cannot open '/dev/shm/*.log' for reading: No such file or directory
tail: no files remaining
root@debian:~# dmesg
root@debian:~#
