Just in case you want to borrow some ideas:
Hardened Debian - Security Focused Linux Distribution based on Debian - In Development - Feedback Wanted!
Nice find. Gives insight as to what an advanced intel agency’s COMSEC idea of a secure OS looks like. Though surprisingly they choose IPsec over OpenVPN and decide to go bare-backing SSH without something like Tor.
Yes, I think it’s a good idea.
I don’t like the state of information available for hardening Debian. (Official) Resources are obsolete and blog articles are usually recipes with no background . Whonix wiki seems to be the only thing that’s relevant for general advice. Good job everyone!
- More restrictive Umask settings
- A metapackage to remove bloat and insecure packages [?]
- Non-permissive iptables settings [?] :would probably be wonky since use cases would be juggled between vanilla debian and Whonix, though
- More aggressive service disables in systemd[?]
- Make new services disabled-by-default instead of enabled-on-install
A great idea - some of it might be of interest to Tails team too?
It will be good if it will use Pandora. Pandora automatically overwrites the RAM when the system is shutting down.
Also a good idea is to onionize souces.list and use Tor for updates. Maybe to use Anon Connection Wizard in case someone need to use proxy before Tor
Speaking of keeping dependencies down, if you could limit the dependencies to only what is necessary I will help you port the packages to Ubuntu. I started doing this for Whonix packages a couple years ago but there was enough differences in the Ubuntu/Debian KDE versions and dependancies that it became impossible so I dropped it. But I think if you stuck to minimal dependancies this will be much easier.
That would open up a whole new user base.
Dependencies for individual packages are minimal. Necessary stuff only.
Could you please have a look at some packages and let me know if
dependencies are non-minimal?
Many years ago (maybe up to Whonix 7 or so) there were no separate
packages but only packages like whonix-shared, whonix-gateway and
whonix-workstation with all files but that has long been deprecated in
favor of separate packages.
Hardened Debian would make a great introduction to Linux for Windows users who might want to try Linux out for the first time. Much of the documentation from the proposed
"whonix-can-become-a-distribution-targeting-first-time-linux-users" project could be used for this. Maybe even combine the two projects for maximum usefulness? I think that would be very reasonable with some community contributions.
We can’t call it
As per https://www.debian.org/trademark a new name as to be found.
- Use the Debian trademarks in their exact form, neither abbreviated or hyphenated, nor combined with any other word or words.
A new project name has to be found.
- It shouldn’t imply anonymity anything.
- We shouldn’t be watering down the
Whonixbrand by calling it
WhonixClearnetor something. (That name would be a contradiction too.)
Very true indeed no diluting the hard (pun unintended) earned recogniztion allowed.
There is always that pre-existing notion in many users mind when they encounter the term “hardened” . Clearly the efforts often stray towards the notion with a “kernel” centric focus.
I am pretty sure Whonix efforts continue to encompass more.
The first word or English adjective that came to mind was “enhanced”
Perhaps to add to the consideration, the other words include
terms such as fortified, or reinforced.
Would you smile if I think out aloud with Whonix Steel / Whonix Stahl or even Whonix Stalo (in Esperanto)
I like that. Maybe someone could come up with a good acronym. For example:
Security Enhanced Linux Distribution
(Brought to you by the developers of Whonix)
One possible issue is that might imply a “Steel anonymity distribution” . I think Whonix should be mentioned but maybe not in the actual name.
That’s a good idea. However both examples have google results already.
BTW… I was wondering if you and your entourage have already ideas on this effort become a darling template in Qubes as well. (No No but not as a HVM puhleese) Am I dreaming…? pinch me
HaLos. Hardened Linux Operating System
Hay-Low. The “
s” is silent.
The thing is, can we get to google rank 1 after a while? I see halos already being used for other things.
VigorOS? as in https://www.dictionary.com/browse/vigorous
Thats just wont happen for new comers to GNU/Linux. its self contradictory statement because Windows is for noobs when they come to Debian needs alot of changes and when there is “Hardened Debian” thats requires even more.
But if hardened debian going to be so idiotic one based on newbies configurations just like Ubuntu then no need the headache , freshly minimized Debian way much better in this case. (and most likely wont be considered hardened anyway…)
What about LEDAR, Linux Environment Designed for Attack Resistance?
We can’t call it
HardenedDeb or anything including
Generally we don’t encourage any derivatives to use parts of Debian’s name in their name, as it increases likelihood of confusion that it’s an official product of the Debian Project.
That said, we are perfectly happy with derivatives saying true statements like “…, based on Debian” or “Debian based”.
Advanced Adversary Resistant Operating System
1 : responsive to or conscious of sense impressions sentient beings
2 : aware
3 : finely sensitive in perception or feeling
Trying to come up with a good acronym which uses
Advanced. N. Threat. I. -OS
Haven’t gotten that far.