Without TCP ISN randomization, patterns in outgoing traffic can reveal unique characteristics of a system’s CPU, compromising user security.
TCP ISN randomization
helps preserve security by masking these signals.
You can easily try Kicksecure by using
various virtualizers
, which enables security compartmentalization by running a Kicksecure VM on top of a Kicksecure host to isolate malware and testing inside the VM.
Strong entropy is required for computer security to ensure the unpredictability and randomness of cryptographic keys and other security-related processes. Kicksecure makes encryption more secure thanks to
preinstalled random number generators.
Our website offers an alternative onion version which offers a higher connection security between the user and the server. This is because connections over onions are providing an alternative end-to-end
encryption which is independent from
flawed TLS certificate authorities
and the mainstream Domain Name System (DNS).
Kicksecure increases safety by using separate accounts for daily use and admin tasks. This is called
user-sysmaint-split. It prevents routine software—like a hacked browser—from gaining full system access or installing
rootkits.
To prevent /tmp-based attacks,
Kicksecure uses libpam-tmpdir, which creates secure, per-user temporary folders and sets strict permissions. This blocks common
threats like symlink exploits.
Kicksecure enforces
strict file permission settings in /home, automatically removing read, write, and execute access for others during setup or
account creation. This prevents users from accessing each other's files and corrects unsafe permissions that may exist from earlier configurations. The approach aligns with hardening principles from the
Securing Debian Manual.
To reduce the risk of unintended file exposure,
Kicksecure sets a stricter default umask
for non-root accounts so that new files are inaccessible to other accounts by default. This enhances security beyond the /home folder, especially in shared areas like folder /var.
In oversimplified terms, Kicksecure is just a collection of configuration files and scripts. Kicksecure is not a stripped down version of Debian; anything possible in "vanilla" Debian GNU/Linux can be
replicated in Kicksecure.
About Kicksecure
The purpose of
SUID Disabler and Permission Hardener
is to enhance system security. It does this by strengthening the isolation of Linux user accounts, implementing stricter file permission settings, and decreasing potential security vulnerabilities by
turning off SUID-enabled binaries.
Checking digital signatures
helps protect users from harmful software (malware or viruses). It proves the software is real, hasn't been tampered with, and keeps users safer.
The Kicksecure Digital Signature Policy
requires signed git commits, tags, and images. Unsigned code is strictly prohibited in builds and deployments. Documentation encourages digital signature verification.
All the Kicksecure source code is licensed under OSI Approved Licenses. We respect
user rights to review, scrutinize, modify, and redistribute Kicksecure. This improves security and privacy for everyone.
Research
and Implementation Project: Kicksecure makes modest claims and is wary of overconfidence. Kicksecure is an actively maintained research project making constant improvements; no
shortcomings
are ever hidden from users.
