SAW-Kinoite/README.md

Fedora Kinoite SAW (Secure Air-Gapped Workstation)

Overview

This project provides a complete implementation of a Secure Air-Gapped Workstation (SAW) using Fedora Kinoite. It implements multiple layers of security including:

• Immutable OS - Atomic updates with rollback capability
• Locked Down DNS - Only allows connection to VPN gateway
• No Sudo Access - Prevents privilege escalation attacks
• Custom CA Trust - Only packages signed by your Certificate Authority
• WireGuard VPN - Encrypted tunnel for all network traffic
• Package Verification - All packages must be signed and verified
• CRL Checking - Revoked certificates are blocked

Quick Start

Prerequisites

• 8GB+ USB drive
• Fedora Kinoite ISO (base image)
• CA certificate and private key
• WireGuard VPN server access

Build ISO

# Install build tools
sudo dnf install -y lorax anaconda-tools

# Build custom ISO
cd /home/user/playground/SAW-Kinoite
sudo bash kickstart/build-iso.sh -i /path/to/Fedora-Kinoite-latest.iso

Install

# Write ISO to USB
sudo dd if=output/Fedora-Kinoite-SAW.iso of=/dev/sdX bs=4M status=progress

# Boot from USB and install normally
# Run post-install lockdown
sudo bash /usr/local/bin/lockdown.sh

Configure VPN

# Edit WireGuard configuration
sudo nano /etc/wireguard/wg0.conf

# Start VPN
sudo wg-quick up wg0

# Enable auto-start
sudo systemctl enable wg-quick@wg0

File Structure

SAW-Kinoite/
├── README.md                          # This file
├── INSTALLATION_GUIDE.md              # Detailed installation instructions
├── kickstart/
│   ├── kinoite-saw.ks                 # Kickstart for custom ISO
│   └── build-iso.sh                   # Script to build ISO
├── post-install/
│   ├── lockdown.sh                    # Lockdown script
│   ├── configure-vpn.sh               # WireGuard setup
│   └── setup-updates.sh               # Update approval system
├── package-verification/
│   ├── verify-signature.sh            # Package verification
│   ├── verify-crl.sh                  # CRL verification
│   └── ca/                            # CA configuration
├── scripts/
│   ├── security-audit.sh              # Security audit script
│   ├── check-verification.sh          # Verification checker
│   └── daily-crl-update.sh            # CRL updater cron job
└── config/
    └── wireguard/                     # WireGuard examples

Security Controls

1. Sudo Disabled

• User removed from wheel group
• Root SSH login disabled
• PAM configured for MFA

2. SELinux Enforcing

• Mandatory access control enabled
• All security policies enforced
• Violations logged

3. Audit Daemon

• Comprehensive logging enabled
• Privilege escalation logged
• Critical file access monitored

4. Firewall

• Default deny policy
• Only WireGuard allowed
• DNS lockdown configured

5. DNS Lockdown

• Only VPN gateway DNS allowed
• Private DNS blocked
• All DNS through VPN tunnel

6. Package Verification

• GPG signature verification enabled
• CA key imported
• CRL checking enabled

7. Update Approval System

• Auto-download enabled
• Approval required for updates
• Audit trail maintained

Configuration

Custom CA Certificate

Place your CA certificate at:

package-verification/ca/ca.crt

WireGuard Configuration

Edit the WireGuard config in:

/etc/wireguard/wg0.conf

Update Approval

Use the approval system:

# Check for updates
sudo /usr/local/bin/approve-update.sh --check

# Approve and apply
sudo /usr/local/bin/approve-update.sh --approve

Daily Tasks

# Check for updates
sudo rpm-ostree status

# Check VPN status
sudo wg show

# Check firewall
sudo firewall-cmd --list-all

# View security logs
sudo ausearch -m avc -ts recent

Weekly Tasks

# Run security audit
sudo /usr/local/bin/security-audit.sh

# Verify package signatures
sudo /usr/local/bin/check-verification.sh

# Check disk space
df -h

Monthly Tasks

# Update CA certificate
# Update CRL
# Review audit logs
# Test rollback capability

Troubleshooting

Package Signature Verification Failed

# Verify CA key is installed
ls /etc/pki/rpm-gpg/

# Re-import CA key
sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca

# Check package signature
rpm --checksig package.rpm

VPN Not Connecting

# Check WireGuard config
cat /etc/wireguard/wg0.conf

# Check interface
sudo wg show

# Check firewall
sudo firewall-cmd --list-services

System Rollback

# List previous deployments
sudo rpm-ostree status

# Rollback to previous
sudo rpm-ostree rollback
sudo reboot

Security Best Practices

Do

• ✅ Keep CA key offline and secure
• ✅ Regularly update CRL
• ✅ Review audit logs
• ✅ Test rollback before production
• ✅ Keep system updated
• ✅ Verify signatures on all packages

Don't

• ❌ Store CA key on the SAW
• ❌ Disable signature verification
• ❌ Allow unsigned packages
• ❌ Disable audit logging
• ❌ Store passwords in plaintext
• ❌ Disable SELinux

References

Fedora Documentation

• Fedora Kinoite
• Fedora CoreOS Documentation
• DNF Configuration
• SELinux User Guide
• firewalld

Security References

• NSA Linux Security Hardening Guide
• CIS Fedora Benchmarks
• NIST Security Guides

Tools Used

• rpm-ostree
• Flatpak
• WireGuard
• firewalld
• auditd
• dnsmasq

License

This implementation is provided as-is for educational and organizational use.

Disclaimer: This guide provides a starting point. Customize for your specific security requirements and environment. Always test in a safe environment before production deployment.

Support

For issues or questions:

1. Check the troubleshooting section
2. Review audit logs
3. Test with minimal configuration
4. Verify all prerequisites

---

Version: 1.0
Date: 2026-04-02
Author: Fedora Kinoite SAW Implementation