commit e279804b1d883ac8b8387ce10268cc28b96197cf Author: Jarian Cottingham Date: Thu Apr 2 17:22:41 2026 -0500 first commit diff --git a/README.md b/README.md new file mode 100644 index 0000000..b6a419e --- /dev/null +++ b/README.md @@ -0,0 +1,288 @@ +# Fedora Kinoite SAW (Secure Air-Gapped Workstation) + +## Overview + +This project provides a complete implementation of a **Secure Air-Gapped Workstation (SAW)** using Fedora Kinoite. It implements multiple layers of security including: + +- **Immutable OS** - Atomic updates with rollback capability +- **Locked Down DNS** - Only allows connection to VPN gateway +- **No Sudo Access** - Prevents privilege escalation attacks +- **Custom CA Trust** - Only packages signed by your Certificate Authority +- **WireGuard VPN** - Encrypted tunnel for all network traffic +- **Package Verification** - All packages must be signed and verified +- **CRL Checking** - Revoked certificates are blocked + +## Quick Start + +### Prerequisites + +- 8GB+ USB drive +- Fedora Kinoite ISO (base image) +- CA certificate and private key +- WireGuard VPN server access + +### Build ISO + +```bash +# Install build tools +sudo dnf install -y lorax anaconda-tools + +# Build custom ISO +cd /home/user/playground/SAW-Kinoite +sudo bash kickstart/build-iso.sh -i /path/to/Fedora-Kinoite-latest.iso +``` + +### Install + +```bash +# Write ISO to USB +sudo dd if=output/Fedora-Kinoite-SAW.iso of=/dev/sdX bs=4M status=progress + +# Boot from USB and install normally +# Run post-install lockdown +sudo bash /usr/local/bin/lockdown.sh +``` + +### Configure VPN + +```bash +# Edit WireGuard configuration +sudo nano /etc/wireguard/wg0.conf + +# Start VPN +sudo wg-quick up wg0 + +# Enable auto-start +sudo systemctl enable wg-quick@wg0 +``` + +## File Structure + +``` +SAW-Kinoite/ +├── README.md # This file +├── INSTALLATION_GUIDE.md # Detailed installation instructions +├── kickstart/ +│ ├── kinoite-saw.ks # Kickstart for custom ISO +│ └── build-iso.sh # Script to build ISO +├── post-install/ +│ ├── lockdown.sh # Lockdown script +│ ├── configure-vpn.sh # WireGuard setup +│ └── setup-updates.sh # Update approval system +├── package-verification/ +│ ├── verify-signature.sh # Package verification +│ ├── verify-crl.sh # CRL verification +│ └── ca/ # CA configuration +├── scripts/ +│ ├── security-audit.sh # Security audit script +│ ├── check-verification.sh # Verification checker +│ └── daily-crl-update.sh # CRL updater cron job +└── config/ + └── wireguard/ # WireGuard examples +``` + +## Security Controls + +### 1. Sudo Disabled +- User removed from wheel group +- Root SSH login disabled +- PAM configured for MFA + +### 2. SELinux Enforcing +- Mandatory access control enabled +- All security policies enforced +- Violations logged + +### 3. Audit Daemon +- Comprehensive logging enabled +- Privilege escalation logged +- Critical file access monitored + +### 4. Firewall +- Default deny policy +- Only WireGuard allowed +- DNS lockdown configured + +### 5. DNS Lockdown +- Only VPN gateway DNS allowed +- Private DNS blocked +- All DNS through VPN tunnel + +### 6. Package Verification +- GPG signature verification enabled +- CA key imported +- CRL checking enabled + +### 7. Update Approval System +- Auto-download enabled +- Approval required for updates +- Audit trail maintained + +## Configuration + +### Custom CA Certificate + +Place your CA certificate at: +``` +package-verification/ca/ca.crt +``` + +### WireGuard Configuration + +Edit the WireGuard config in: +``` +/etc/wireguard/wg0.conf +``` + +### Update Approval + +Use the approval system: +```bash +# Check for updates +sudo /usr/local/bin/approve-update.sh --check + +# Approve and apply +sudo /usr/local/bin/approve-update.sh --approve +``` + +## Daily Tasks + +```bash +# Check for updates +sudo rpm-ostree status + +# Check VPN status +sudo wg show + +# Check firewall +sudo firewall-cmd --list-all + +# View security logs +sudo ausearch -m avc -ts recent +``` + +## Weekly Tasks + +```bash +# Run security audit +sudo /usr/local/bin/security-audit.sh + +# Verify package signatures +sudo /usr/local/bin/check-verification.sh + +# Check disk space +df -h +``` + +## Monthly Tasks + +```bash +# Update CA certificate +# Update CRL +# Review audit logs +# Test rollback capability +``` + +## Troubleshooting + +### Package Signature Verification Failed + +```bash +# Verify CA key is installed +ls /etc/pki/rpm-gpg/ + +# Re-import CA key +sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca + +# Check package signature +rpm --checksig package.rpm +``` + +### VPN Not Connecting + +```bash +# Check WireGuard config +cat /etc/wireguard/wg0.conf + +# Check interface +sudo wg show + +# Check firewall +sudo firewall-cmd --list-services +``` + +### System Rollback + +```bash +# List previous deployments +sudo rpm-ostree status + +# Rollback to previous +sudo rpm-ostree rollback +sudo reboot +``` + +## Security Best Practices + +### Do + +- ✅ Keep CA key offline and secure +- ✅ Regularly update CRL +- ✅ Review audit logs +- ✅ Test rollback before production +- ✅ Keep system updated +- ✅ Verify signatures on all packages + +### Don't + +- ❌ Store CA key on the SAW +- ❌ Disable signature verification +- ❌ Allow unsigned packages +- ❌ Disable audit logging +- ❌ Store passwords in plaintext +- ❌ Disable SELinux + +## References + +### Fedora Documentation + +- [Fedora Kinoite](https://kinoite.fedoraproject.org/) +- [Fedora CoreOS Documentation](https://docs.fedoraproject.org/coreos/) +- [DNF Configuration](https://dnf.readthedocs.io/) +- [SELinux User Guide](https://docs.fedoraproject.org/en-US/SELinux/) +- [firewalld](https://firewalld.org/documentation/) + +### Security References + +- [NSA Linux Security Hardening Guide](https://media.defense.gov/2022/Aug/29/2003066302/-1/-1/0/CSA_LINX_HARDEN_20220829.PDF) +- [CIS Fedora Benchmarks](https://www.cisecurity.org/benchmark/ubuntu_linux/) +- [NIST Security Guides](https://csrc.nist.gov/publications) + +### Tools Used + +- [rpm-ostree](https://github.com/ostreedev/rpm-ostree) +- [Flatpak](https://flatpak.org/) +- [WireGuard](https://www.wireguard.com/) +- [firewalld](https://firewalld.org/) +- [auditd](https://people.redhat.com/sgrubb/audit/) +- [dnsmasq](http://www.thekelleys.org.uk/dnsmasq/docs.html) + +## License + +This implementation is provided as-is for educational and organizational use. + +**Disclaimer:** This guide provides a starting point. Customize for your specific security requirements and environment. Always test in a safe environment before production deployment. + +## Support + +For issues or questions: +1. Check the troubleshooting section +2. Review audit logs +3. Test with minimal configuration +4. Verify all prerequisites + +--- + +**Version:** 1.0 +**Date:** 2026-04-02 +**Author:** Fedora Kinoite SAW Implementation \ No newline at end of file