Without TCP ISN randomization, patterns in outgoing traffic can reveal unique characteristics of a system’s CPU, compromising user security.
TCP ISN randomization
helps preserve security by masking these signals.
You can easily try Kicksecure by using
various virtualizers
, which enables security compartmentalization by running a Kicksecure VM on top of a Kicksecure host to isolate malware and testing inside the VM.
Strong entropy is required for computer security to ensure the unpredictability and randomness of cryptographic keys and other security-related processes. Kicksecure makes encryption more secure thanks to
preinstalled random number generators.
USBGuard uses the Linux USB device authorization feature and a rule-based policy to allow, block, or reject USB devices based on their attributes. Kicksecure’s policy is designed to refuse suspicious or unexpected devices plugged in after boot, helping reduce exposure to BadUSB-style attacks.
USBGuard is an additional layer, not a replacement for only using trusted USB devices, and it cannot stop physical damage attacks (for example "USB killer") or filter keystrokes from a device you have already allowed.
Linux is highly reliable and secure. Its Open Source freedom paradigm sets it apart from other operating systems. That's why Kicksecure
is based on Linux.
Our website offers an
alternative onion service
, which provides higher connection security between the user and the server. This is because connections over onion services provide an alternative end-to-end
encryption that is independent of
flawed TLS certificate authorities
and the mainstream Domain Name System (DNS).
Kicksecure implements strong Linux user account isolation through Console Lockdown, root login disabled, and restrictions on su and sudo. It also applies Permission Lockdown so other accounts cannot read your home folder by default, sets a more restrictive default umask (for example 027), and provides per-user /tmp isolation via libpam-tmpdir. Online password cracking is limited by locking accounts after repeated failed login attempts.
Learn more about our
Strong Linux User Account Isolation.
Kicksecure increases safety by using separate accounts for daily use and admin tasks. This is called
user-sysmaint-split. It prevents routine software, like a hacked browser, from gaining full system access or installing
rootkits.
To prevent /tmp-based attacks,
Kicksecure uses libpam-tmpdir, which creates secure, per-user temporary folders and sets strict permissions. This blocks common
threats like symlink exploits.
Kicksecure enforces
strict file permission settings in /home, automatically removing read, write, and execute access for others during setup or
account creation. This prevents users from accessing each other's files and corrects unsafe permissions that may exist from earlier configurations. The approach aligns with hardening principles from the
Securing Debian Manual.
To reduce the risk of unintended file exposure,
Kicksecure sets a stricter default umask
for non-root accounts so that new files are inaccessible to other accounts by default. This enhances security beyond the /home folder, especially in shared areas like the folder /var.
In oversimplified terms, Kicksecure is just a collection of configuration files and scripts. Kicksecure is not a stripped down version of Debian; anything possible in "vanilla" Debian GNU/Linux can be
replicated in Kicksecure.
About Kicksecure
swap-file-creator
creates a new swap file on every boot when the target path is on a LUKS-encrypted device. By default, it does not create swap on unencrypted disks, but this can be overridden (not recommended for privacy).
The purpose of
SUID Disabler and Permission Hardener
is to enhance system security. It does this by strengthening the isolation of Linux user accounts, implementing stricter file permission settings, and decreasing potential security vulnerabilities by
turning off SUID-enabled binaries.
Checking digital signatures
helps protect users from harmful software (malware or viruses). It proves the software is real, hasn't been tampered with, and keeps users safer.
The Kicksecure Digital Signature Policy
requires signed git commits, tags, and images. Unsigned code is strictly prohibited in builds and deployments. Documentation encourages digital signature verification.
All the Kicksecure source code is licensed under OSI Approved Licenses. We respect
user rights to review, scrutinize, modify, and redistribute Kicksecure. This improves security and privacy for everyone.
Research
and Implementation Project: Kicksecure makes modest claims and is wary of overconfidence. Kicksecure is an actively maintained research project making constant improvements; no
shortcomings
are ever hidden from users.
Deep scan readiness
means you can power the device off and inspect it from outside, for example by booting a trusted Live USB or scanning the disk from another computer. This enables full system checks, including bootloader and kernel components, and reduces the risk of malware hiding itself during a scan.
sandbox-app-launcher aims to run each desktop application as its own user inside a restrictive bubblewrap sandbox, confined by AppArmor and filtered with seccomp. This is intended to reduce the blast radius of a compromised app by limiting filesystem access, IPC, and dangerous system calls.
The project is a work in progress and is currently developers-only.
apparmor.d is a full system AppArmor policy that aims to confine all user space processes, starting from init and systemd, and then applying profiles to services and applications. The goal is "AppArmor for everything" and stronger least-privilege enforcement across the whole OS.
This is still in development and not yet supported or available for general users.
VirusForget is a design effort to make non-root malware persistence harder by cleaning up common autostart and hook locations in the user profile at boot. The idea is to reset or quarantine unexpected changes (for example in dotfiles and autostart entries) so that a compromise of the user account does not automatically survive a reboot.
This is an active design topic and not yet a finished, default-enabled feature.
hardened-kernel combines a hardened kernel configuration with hardening patches from the linux-hardened project. A VM-focused configuration can disable most hardware drivers to reduce attack surface, while a host configuration targets broader hardware support.
For additional hardening, the VM kernel is designed to be compiled locally, producing unique symbols that can make some classes of kernel exploits harder.
This enhancement builds on Reduce Kernel Information Leaks in security-misc. It restricts non-root access to sensitive hardware and kernel metadata (for example parts of /sys and /proc) to reduce fingerprinting and limit what locally running malware can learn.
It is currently disabled by default because it can break applications, and root can still access this information.
hidepid hardens process privacy by mounting /proc so unprivileged users can only see their own processes. This reduces cross-user information leakage and helps isolation on multi-user systems.
It is opt-in because it can break some workflows and tools (for example pkexec) unless additional compatibility workarounds are applied.
Mount options such as noexec, nodev, and nosuid reduce risk in writable data locations by preventing direct execution, device node interpretation, and SUID/SGID privilege escalation from those paths. The goal is to make common persistence and "run-from-home" attack patterns harder.
Some advanced workflows may need adjustments or an opt-out when running programs from home directories.
Restricting access to compilers and interpreters reduces the ability of malware to compile or run arbitrary code on the system after an initial compromise. This is intended as a defense-in-depth measure alongside sandboxing and mount hardening.
Developers and power users will still be able to opt out when they need toolchains locally.
Post-quantum cryptography (PQC) aims to provide digital signatures that remain secure even if future quantum computers can break widely used algorithms such as RSA and ECC. This enhancement explores adding quantum-resistant signing for releases, for example using Codecrypt, a GnuPG-like tool that uses quantum-resistant algorithms for encryption and signatures.
PQC signing would complement existing signatures to strengthen long-term integrity and update trust.
