first commit
This commit is contained in:
commit
e279804b1d
288
README.md
Normal file
288
README.md
Normal file
@ -0,0 +1,288 @@
|
||||
# Fedora Kinoite SAW (Secure Air-Gapped Workstation)
|
||||
|
||||
## Overview
|
||||
|
||||
This project provides a complete implementation of a **Secure Air-Gapped Workstation (SAW)** using Fedora Kinoite. It implements multiple layers of security including:
|
||||
|
||||
- **Immutable OS** - Atomic updates with rollback capability
|
||||
- **Locked Down DNS** - Only allows connection to VPN gateway
|
||||
- **No Sudo Access** - Prevents privilege escalation attacks
|
||||
- **Custom CA Trust** - Only packages signed by your Certificate Authority
|
||||
- **WireGuard VPN** - Encrypted tunnel for all network traffic
|
||||
- **Package Verification** - All packages must be signed and verified
|
||||
- **CRL Checking** - Revoked certificates are blocked
|
||||
|
||||
## Quick Start
|
||||
|
||||
### Prerequisites
|
||||
|
||||
- 8GB+ USB drive
|
||||
- Fedora Kinoite ISO (base image)
|
||||
- CA certificate and private key
|
||||
- WireGuard VPN server access
|
||||
|
||||
### Build ISO
|
||||
|
||||
```bash
|
||||
# Install build tools
|
||||
sudo dnf install -y lorax anaconda-tools
|
||||
|
||||
# Build custom ISO
|
||||
cd /home/user/playground/SAW-Kinoite
|
||||
sudo bash kickstart/build-iso.sh -i /path/to/Fedora-Kinoite-latest.iso
|
||||
```
|
||||
|
||||
### Install
|
||||
|
||||
```bash
|
||||
# Write ISO to USB
|
||||
sudo dd if=output/Fedora-Kinoite-SAW.iso of=/dev/sdX bs=4M status=progress
|
||||
|
||||
# Boot from USB and install normally
|
||||
# Run post-install lockdown
|
||||
sudo bash /usr/local/bin/lockdown.sh
|
||||
```
|
||||
|
||||
### Configure VPN
|
||||
|
||||
```bash
|
||||
# Edit WireGuard configuration
|
||||
sudo nano /etc/wireguard/wg0.conf
|
||||
|
||||
# Start VPN
|
||||
sudo wg-quick up wg0
|
||||
|
||||
# Enable auto-start
|
||||
sudo systemctl enable wg-quick@wg0
|
||||
```
|
||||
|
||||
## File Structure
|
||||
|
||||
```
|
||||
SAW-Kinoite/
|
||||
├── README.md # This file
|
||||
├── INSTALLATION_GUIDE.md # Detailed installation instructions
|
||||
├── kickstart/
|
||||
│ ├── kinoite-saw.ks # Kickstart for custom ISO
|
||||
│ └── build-iso.sh # Script to build ISO
|
||||
├── post-install/
|
||||
│ ├── lockdown.sh # Lockdown script
|
||||
│ ├── configure-vpn.sh # WireGuard setup
|
||||
│ └── setup-updates.sh # Update approval system
|
||||
├── package-verification/
|
||||
│ ├── verify-signature.sh # Package verification
|
||||
│ ├── verify-crl.sh # CRL verification
|
||||
│ └── ca/ # CA configuration
|
||||
├── scripts/
|
||||
│ ├── security-audit.sh # Security audit script
|
||||
│ ├── check-verification.sh # Verification checker
|
||||
│ └── daily-crl-update.sh # CRL updater cron job
|
||||
└── config/
|
||||
└── wireguard/ # WireGuard examples
|
||||
```
|
||||
|
||||
## Security Controls
|
||||
|
||||
### 1. Sudo Disabled
|
||||
- User removed from wheel group
|
||||
- Root SSH login disabled
|
||||
- PAM configured for MFA
|
||||
|
||||
### 2. SELinux Enforcing
|
||||
- Mandatory access control enabled
|
||||
- All security policies enforced
|
||||
- Violations logged
|
||||
|
||||
### 3. Audit Daemon
|
||||
- Comprehensive logging enabled
|
||||
- Privilege escalation logged
|
||||
- Critical file access monitored
|
||||
|
||||
### 4. Firewall
|
||||
- Default deny policy
|
||||
- Only WireGuard allowed
|
||||
- DNS lockdown configured
|
||||
|
||||
### 5. DNS Lockdown
|
||||
- Only VPN gateway DNS allowed
|
||||
- Private DNS blocked
|
||||
- All DNS through VPN tunnel
|
||||
|
||||
### 6. Package Verification
|
||||
- GPG signature verification enabled
|
||||
- CA key imported
|
||||
- CRL checking enabled
|
||||
|
||||
### 7. Update Approval System
|
||||
- Auto-download enabled
|
||||
- Approval required for updates
|
||||
- Audit trail maintained
|
||||
|
||||
## Configuration
|
||||
|
||||
### Custom CA Certificate
|
||||
|
||||
Place your CA certificate at:
|
||||
```
|
||||
package-verification/ca/ca.crt
|
||||
```
|
||||
|
||||
### WireGuard Configuration
|
||||
|
||||
Edit the WireGuard config in:
|
||||
```
|
||||
/etc/wireguard/wg0.conf
|
||||
```
|
||||
|
||||
### Update Approval
|
||||
|
||||
Use the approval system:
|
||||
```bash
|
||||
# Check for updates
|
||||
sudo /usr/local/bin/approve-update.sh --check
|
||||
|
||||
# Approve and apply
|
||||
sudo /usr/local/bin/approve-update.sh --approve
|
||||
```
|
||||
|
||||
## Daily Tasks
|
||||
|
||||
```bash
|
||||
# Check for updates
|
||||
sudo rpm-ostree status
|
||||
|
||||
# Check VPN status
|
||||
sudo wg show
|
||||
|
||||
# Check firewall
|
||||
sudo firewall-cmd --list-all
|
||||
|
||||
# View security logs
|
||||
sudo ausearch -m avc -ts recent
|
||||
```
|
||||
|
||||
## Weekly Tasks
|
||||
|
||||
```bash
|
||||
# Run security audit
|
||||
sudo /usr/local/bin/security-audit.sh
|
||||
|
||||
# Verify package signatures
|
||||
sudo /usr/local/bin/check-verification.sh
|
||||
|
||||
# Check disk space
|
||||
df -h
|
||||
```
|
||||
|
||||
## Monthly Tasks
|
||||
|
||||
```bash
|
||||
# Update CA certificate
|
||||
# Update CRL
|
||||
# Review audit logs
|
||||
# Test rollback capability
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Package Signature Verification Failed
|
||||
|
||||
```bash
|
||||
# Verify CA key is installed
|
||||
ls /etc/pki/rpm-gpg/
|
||||
|
||||
# Re-import CA key
|
||||
sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca
|
||||
|
||||
# Check package signature
|
||||
rpm --checksig package.rpm
|
||||
```
|
||||
|
||||
### VPN Not Connecting
|
||||
|
||||
```bash
|
||||
# Check WireGuard config
|
||||
cat /etc/wireguard/wg0.conf
|
||||
|
||||
# Check interface
|
||||
sudo wg show
|
||||
|
||||
# Check firewall
|
||||
sudo firewall-cmd --list-services
|
||||
```
|
||||
|
||||
### System Rollback
|
||||
|
||||
```bash
|
||||
# List previous deployments
|
||||
sudo rpm-ostree status
|
||||
|
||||
# Rollback to previous
|
||||
sudo rpm-ostree rollback
|
||||
sudo reboot
|
||||
```
|
||||
|
||||
## Security Best Practices
|
||||
|
||||
### Do
|
||||
|
||||
- ✅ Keep CA key offline and secure
|
||||
- ✅ Regularly update CRL
|
||||
- ✅ Review audit logs
|
||||
- ✅ Test rollback before production
|
||||
- ✅ Keep system updated
|
||||
- ✅ Verify signatures on all packages
|
||||
|
||||
### Don't
|
||||
|
||||
- ❌ Store CA key on the SAW
|
||||
- ❌ Disable signature verification
|
||||
- ❌ Allow unsigned packages
|
||||
- ❌ Disable audit logging
|
||||
- ❌ Store passwords in plaintext
|
||||
- ❌ Disable SELinux
|
||||
|
||||
## References
|
||||
|
||||
### Fedora Documentation
|
||||
|
||||
- [Fedora Kinoite](https://kinoite.fedoraproject.org/)
|
||||
- [Fedora CoreOS Documentation](https://docs.fedoraproject.org/coreos/)
|
||||
- [DNF Configuration](https://dnf.readthedocs.io/)
|
||||
- [SELinux User Guide](https://docs.fedoraproject.org/en-US/SELinux/)
|
||||
- [firewalld](https://firewalld.org/documentation/)
|
||||
|
||||
### Security References
|
||||
|
||||
- [NSA Linux Security Hardening Guide](https://media.defense.gov/2022/Aug/29/2003066302/-1/-1/0/CSA_LINX_HARDEN_20220829.PDF)
|
||||
- [CIS Fedora Benchmarks](https://www.cisecurity.org/benchmark/ubuntu_linux/)
|
||||
- [NIST Security Guides](https://csrc.nist.gov/publications)
|
||||
|
||||
### Tools Used
|
||||
|
||||
- [rpm-ostree](https://github.com/ostreedev/rpm-ostree)
|
||||
- [Flatpak](https://flatpak.org/)
|
||||
- [WireGuard](https://www.wireguard.com/)
|
||||
- [firewalld](https://firewalld.org/)
|
||||
- [auditd](https://people.redhat.com/sgrubb/audit/)
|
||||
- [dnsmasq](http://www.thekelleys.org.uk/dnsmasq/docs.html)
|
||||
|
||||
## License
|
||||
|
||||
This implementation is provided as-is for educational and organizational use.
|
||||
|
||||
**Disclaimer:** This guide provides a starting point. Customize for your specific security requirements and environment. Always test in a safe environment before production deployment.
|
||||
|
||||
## Support
|
||||
|
||||
For issues or questions:
|
||||
1. Check the troubleshooting section
|
||||
2. Review audit logs
|
||||
3. Test with minimal configuration
|
||||
4. Verify all prerequisites
|
||||
|
||||
---
|
||||
|
||||
**Version:** 1.0
|
||||
**Date:** 2026-04-02
|
||||
**Author:** Fedora Kinoite SAW Implementation
|
||||
Loading…
x
Reference in New Issue
Block a user