Install Kicksecure inside Debian

From Kicksecure
Jump to navigation Jump to search

An existing Debian version 12 (codename: bookworm) installation can be converted into Kicksecure by installing a Kicksecure deb package. This procedure is also called distro-morphing.

There is no downloadable iso yet but it will be available in the future. In the meantime install Debian on the host or inside a VM, then install Kicksecure on top.

Introduction[edit]

notice This is a pre-release. (What does that mean?)

To increase the chances of success, it is best to start with a minimal Debian installation either,

  • A) Debian graphical user interface (GUI) Xfce
  • B) or Debian command line interface (CLI)

and then install a Kicksecure meta package as documented below.

It is easiest to set the Linux user account name to user during the installation of Debian bookworm.

Prerequisites[edit]

1. Essentials.

The user needs to verify that the following prerequisites are met.

  • Debian bookworm installed.
  • A user account such as for example user user exists.
  • Calling the user name user is recommended because then you could copy and paste the commands below and do not need to adjust for another user name.

2. Gain administrative (root) rights. [1]

Becoming root is required because the following commands need to be run with administrative (root) rights as documented below. [2]

  • A) Debian: Use su as documented below.
  • B) Most Qubes users: same as above.
  • C) Advanced Qubes users: If using a Debian minimal template or not having the passwordless-root package installed, see footnote. [3]

Run the following command in a terminal.

su

3. Install sudo and adduser package.

1. Update the package lists.

apt update

2. Upgrade the system.

apt full-upgrade

3. Install sudo and adduser package.

apt install --no-install-recommends sudo adduser

5. Create group console.

/usr/sbin/addgroup --system console

6. Add your Linux account user name to group console.

Note: Replace user user with your actual user name.

/usr/sbin/adduser user console

7. Add user user to group sudo.

Note:

  • A) Most users: No special notice.
  • B) Advanced users: If the user is intending to lockdown user user by not granting root rights, see footnote. [4]

Note: Replace user user with your actual user name.

/usr/sbin/adduser user sudo

8. Reboot.

/sbin/reboot

Installation[edit]

Add the Kicksecure Repository[edit]

There are two different options to enable the Kicksecure APT repository.

Using extrepo

1. Install package extrepo.

sudo apt install extrepo

2. Enable the stable kicksecure APT repository. (See footnote for other options.) [5]

A : Kicksecure

===

Kicksecure

sudo extrepo enable kicksecure

B : Kicksecure for Qubes Template

===

Kicksecure-Qubes Template (kicksecure-17)

sudo http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 extrepo enable kicksecure

3. Advanced options.

For advanced options such as clearnet over Tor or onion. [6]

Please press on expand on the right side.

Optional.

Install apt-transport-tor.

Install apt-transport-tor. To accomplish that, the following steps A. to D. need to be done.

A. Update the package lists.

sudo apt update

B. Upgrade the system.

sudo apt full-upgrade

C. Install the apt-transport-tor package.

Using apt command line parameter --no-install-recommends is in most cases optional.

sudo apt install --no-install-recommends apt-transport-tor

D. Done.

The procedure of installing apt-transport-tor is complete.

Find out filename.

ls -la /etc/apt/sources.list.d/extrepo_*

NOTE: Filename will be different if using a repository other than the stable repository such as the testers repository.

Open file /etc/apt/sources.list.d/extrepo_kicksecure.sources in an editor with root rights.

Kicksecure

This box uses sudoedit for better security.

Kicksecure for Qubes

NOTE: When using Kicksecure-Qubes, this needs to be done inside the Template.

Others and Alternatives

  • This is just an example. Other tools could achieve the same goal.
  • If this example does not work for you or if you are not using Kicksecure, please refer to this link.

sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources

Chose either option A) or B).

  • A) Clearnet over Tor Repository: To enable clearnet over Tor, tor+ needs do be prepended in front of the https. The same in other words, look for Uris: https and replace it with Uris: tor+https .
  • B) Onion Repository: To enable onion, look for the line starting with Uris:. Delete the whole line. Or out-comment it by adding as hash ("#") in front of it. Then add a new line: Uris: tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion

4. Done.

The Kicksecure APT repository has been enabled [7]

Manually

Add Signing Key

Complete the following steps to add the Kicksecure Signing Key to the system's APT keyring.

Open a terminal.

1. Package curl needs to be installed.

Install curl. To accomplish that, the following steps A. to D. need to be done.

A. Update the package lists.

sudo apt update

B. Upgrade the system.

sudo apt full-upgrade

C. Install the curl package.

Using apt command line parameter --no-install-recommends is in most cases optional.

sudo apt install --no-install-recommends curl

D. Done.

The procedure of installing curl is complete.

2. Download Kicksecure Signing Key. [8]

A : Debian

If you are using Debian, run.

TLS

sudo curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.kicksecure.com/keys/derivative.asc

onion

Downloading over onion requires an already functional system Tor.

sudo torsocks curl --output /usr/share/keyrings/derivative.asc --url http://www.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion/keys/derivative.asc

B : Qubes

If you are using a Qubes Debian Template, run.

TLS

sudo http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.kicksecure.com/keys/derivative.asc

onion

Downloading over onion requires an already functional system Tor.

sudo torsocks curl --output /usr/share/keyrings/derivative.asc --url http://www.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion/keys/derivative.asc

3. Users can check Kicksecure Signing Key for better security.

4. Done.

The procedure of adding the Kicksecure signing key is now complete.

Add Repository

Add the Kicksecure APT Repository.

Choose either: Option A, Option B OR Option C

A : Onion Rep.

Option A: Add Kicksecure Onion Repository.

To add Kicksecure Repository over Onion please install apt-transport-tor from the Debian repository.

sudo apt install apt-transport-tor

Add Kicksecure APT repository for default Kicksecure using Debian stable. At the time of writing this was bookworm.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

B : Clearnet Rep. via Tor

Option B: Add Kicksecure Clearnet Repository over Tor.

To add Kicksecure Repository over torified clearnet install apt-transport-tor from the Debian repository.

sudo apt install apt-transport-tor

Add Kicksecure APT repository for default Kicksecure using Debian stable. At the time of writing this was bookworm.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+https://deb.kicksecure.com bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

C : Clearnet Rep.

Option C: Add Kicksecure Clearnet Repository over clearnet.

NOTE: When later using Kicksecure repository tool, then this will be upgraded to "Clearnet Rep. via Tor", unless see footnote. [9]

To add Kicksecure Repository over clearnet please add Kicksecure APT repository for default Kicksecure using Debian stable. At the time of writing this was bookworm.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

The procedure of adding the Kicksecure repository is now complete.

Install the Kicksecure Package[edit]

1. Pick a Kicksecure package.

  • CLI version. Command line interface (CLI) version only. This does not modify the graphical desktop environment. This package provides better kernel hardening, improved entropy, and other security features.
    • For host operating systems: kicksecure-cli-host
    • For Qubes users: kicksecure-qubes-cli
    • For any other VMs (not Qubes): kicksecure-cli-vm
  • GUI version. Similar to the CLI version but it installs the Xfce graphical desktop environment and default applications. This is useful if Debian was installed without a graphical desktop environment and the Kicksecure graphical desktop environment (Xfce) is desired.
    • For host operating systems: kicksecure-xfce-host
    • For Qubes users: kicksecure-qubes-gui
    • For any other VMs (not Qubes): kicksecure-xfce-vm

2. Install a Kicksecure package such as kicksecure-cli-host.

Install kicksecure-cli-host. To accomplish that, the following steps A. to D. need to be done.

A. Update the package lists.

sudo apt update

B. Upgrade the system.

sudo apt full-upgrade

C. Install the kicksecure-cli-host package.

Using apt command line parameter --no-install-recommends is in most cases optional.

sudo apt install --no-install-recommends kicksecure-cli-host

D. Done.

The procedure of installing kicksecure-cli-host is complete.

3. Troubleshooting. (Optional.)

Only in case of issues, see footnote. [10] Otherwise proceed to next step.

4. Next.

Post-Installation[edit]

1. Enable the /etc/apt/sources.list.d/derivative.list Kicksecure APT repository.

Can be done using the Kicksecure repository tool.

Two options. Choose one. Either using,

  • A) CLI: sudo repository-dist --enable --repository stable , or
  • B) GUI: Start Menu → System → Derivative Repository → choose either "stable", "stable-proposed-updates" , "Testers" or "Developers" repository

See the tool's wiki page for more detailed documentation if needed.

2. Disable the extrepo kicksecure APT repository.

This is to avoid a duplicate Kicksecure repository.

sudo extrepo disable kicksecure

3. Check APT sources.

Check if some APT sources in /etc/apt/sources.list should be kept.

Move the original /etc/apt/sources.list file out of the way (or delete it) because it is replaced by Kicksecure's /etc/apt/sources.list.d/debian.list.

sudo mv /etc/apt/sources.list ~/

4. Create an empty /etc/apt/sources.list file.

sudo touch /etc/apt/sources.list

5. Optional: Set the onionized Debian repositories.

Follow these instructionsarchive.org if Debian's onion repositories are preferred.

6. Done.

The Kicksecure installation is complete.

Footnotes[edit]

  1. ↑ One way or another.
  2. ↑ When a user is using su to gain administrative rights, the user is required to use full path to the programs addgroup, adduser, reboot because when using su the PATH environment variable is not adjusted for use with root rights. See echo "$PATH". echo "$PATH" user rights PATH printout: 
    /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games

    root rights PATH printout: 

    /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

    By comparison, when using sudo using /full/path/to/application is not required.

  3. ↑ A root terminal is required to proceed which can be started from Qubes dom0 terminal as per the Qubes upstream documentation. Unspecific to Kicksecure.
  4. ↑ The following command /usr/sbin/adduser user sudo grants root rights to user user. If the user intents to use user user without root rights for better security, the user should omit running the /usr/sbin/adduser user sudo and instead 1) make sure that another Linux user account such as user admin is a member of Linux user group sudo and 2) in case of:
    • Debian: Use su.
    • Kicksecure for Qubes: If not installing the passwordless-root package and/or when distribution morphing a Debian minimal template into Kicksecure, root terminal is required to proceed which can be started from Qubes dom0 terminal as per the Qubes upstream documentation. Unspecific to Kicksecure.
  5. ↑ stable-proposed-updates repository: sudo extrepo enable kicksecure_proposed testers repository: sudo extrepo enable kicksecure_testers developers repository: sudo extrepo enable kicksecure_developers
  6. ↑ extrepo feature request: extrepo apt-transport-tor and onion supportarchive.org
  7. ↑ forum discussion: extrepo - safely adding reposarchive.org
  8. ↑ See Secure Downloads to understand why curl and the parameters --tlsv1.3 are used instead of wget.

    Placing an additional signing key into folder /usr/share/keyrings by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder /usr/share/keyrings using the signed-by keyword the signing key will be actually used. Therefore deleting keys in /usr/share/keyrings is optional if intending to disable an APT repository. See also APT Signing Key Folders.
  9. ↑ Unless using repository-dist --transport plain-tls. See also man repository-dist.
  10. ↑ If apt returns an error about console-common when trying to install the Kicksecure package, install console-common first: sudo apt install console-common Then try installing the Kicksecure package again. Meta package installation has been completed. Please proceed with the post-installation steps below.

Unfinished: This wiki is a work in progress. Please do not report broken links until this notice is removed, use Search Engines First and contribute improving this wiki.

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=Debian&oldid=81052"