Kicksecure - Secure by Default Operating System
Donate
A secure by default operating system with the latest security research in place.
Rock Solid Security
Kicksecure is a secure by default OS always based on the latest security research.
Download Now
Learn What Is Kicksecure?
Fully Featured with Advanced Security Components
Protection from Targeted Malicious Updates
Kicksecure update servers know neither the identity nor IP address of the user because all upgrades are downloaded over Tor.
Kernel Self Protection Settings
Kicksecure uses strong Kernel Hardening Settings as recommended by the Kernel Self Protection Project (KSPP).
Time Attack Protection
Kicksecure protects its users from time attacks by implementing Boot Clock Randomization and secure network time synchronization using sdwdate.
No Open Ports by Default
Kicksecure provides a much lower attack surface since there are no open server ports by default unlike in some other Linux distributions.
CPU Information Leak Protection (TCP ISN Randomization)
Without TCP ISN randomization, sensitive information about a system’s CPU activity can leak through outgoing traffic, exposing the system to side-channel attacks. Tirdad protects against this vulnerability.
Available for many virtualizers
With support for multiple virtualization options, trying out Kicksecure is easy. VMs also help contain and prevent the spread of malware.
15 more amazing features →
Brute Force Defense
Kicksecure protects Linux user accounts against brute force attacks by using pam faillock.
Entropy Enhancements
Strong entropy is required for computer security to ensure the unpredictability and randomness of cryptographic keys and other security-related processes. Kicksecure makes encryption more secure thanks to preinstalled random number generators.
Live Mode
Booting into Live Mode is as simple as choosing Live Mode in the boot menu. After the session, all data will be gone.
Based on Linux
Linux is highly reliable, secure, free and Open Source. That's why Kicksecure is based on Linux.
Onion Website for Enhanced Connection Security
Our website offers an alternative onion service version. This offers a higher connection security between the user and the server.
Risk Minimization
AppArmor profiles restrict the capabilities of commonly used, high-risk applications.
Strong Linux User Account Separation
Linux User Account Separation is not always a given on Linux systems. In Kicksecure it is.
Safer System Maintenance through User-Sysmaint-Split
Kicksecure boosts security by separating everyday use from system admin tasks. Two accounts are used by default—one for daily work, one for maintenance—limiting what harm malware could do.
Safer Temporary Files with libpam-tmpdir
Kicksecure includes libpam-tmpdir to improve system security by isolating temporary files per user and tightening file permissions, reducing the risk of /tmp-based and symlink attacks.
Hardening with Securing Debian Manual
Kicksecure applies key system hardening techniques from the Securing Debian Manual by default, and adds original research to boost the baseline security.
Comprehensive Security Documentation
Knowledge is a defense: Kicksecure offers extensive documentation to empower users with critical security information and best practices.
Virus Protection
Kicksecure provides additional security hardening measures and user education for better protection from virus attacks.
Console Lockdown
Legacy login methods can be a security risk. Console Lockdown disables them for improved security hardening.
Home Folder Permission Lockdown
Kicksecure locks down user home folders by default, preventing one user from viewing another's files. This adds an extra layer of privacy and security.
Umask Hardening for Safer File Permissions
Kicksecure improves file security by setting a stricter default umask for non-root accounts, so new files aren’t readable by others unless explicitly allowed.
Based on Debian
Kicksecure is based on Debian, one of the most reliable Linux distributions.
Digitally signed releases
Downloads are signed so genuine Kicksecure releases can be verified.
Warrant Canary
A canary confirms that no warrants have ever been served on the Kicksecure project.
Swap File Creator
Running low on RAM isn't a security problem with swap-file-creator. It will create an encrypted swap file.
SUID Disabler and Permission Hardener
SUID Disabler and Permission Hardener enhances system security by strengthening the isolation of Linux user accounts and more.
Freedom Values
Open Source
We respect user rights to review, scrutinize, modify, and redistribute Kicksecure. This improves security and privacy for everyone.
Freedom Software
Kicksecure is Freedom Software and contains software developed by the Free Software Foundation and the GNU Project.
Research and Implementation Project
Kicksecure is an actively maintained research project making constant improvements; no shortcomings are ever hidden from users.
Fully Auditable
Kicksecure is independently verifiable by security experts and software developers around the world. This improves security and privacy for everyone.
Complete respect for privacy and user freedom
Kicksecure respects data privacy principles. We don’t make advertising deals or collect sensitive personal data.
Upcoming Security Enhancements
8 more Enhancements →
apparmor.d - Full system Mandatory Access Control (MAC) policy - "AppArmor for everything"
Untrusted Root User
Deactivate malware after reboot from non-root compromise
Hardened Linux Kernel
Limit Kernel Information Leaks
Hide Other Users' Processes for Better Isolation
Enhanced Security via Mount Options and Compiler Restrictions
Limit Compiler and Interpreter Access
Post-quantum cryptography resistant signing of releases
Mount Options Hardening
Role-Based Boot Modes, multiple Boot modes for better security (user-sysmaint-split)
Kicksecure update servers know neither the identity nor IP address of the user because all upgrades are downloaded over Tor by default.
Kicksecure uses strong Kernel Hardening Settings as recommended by the Kernel Self Protection Project (KSPP).
Time attacks on Kicksecure users are defeated by Boot Clock Randomization and secure network time synchronization through sdwdate (Secure Distributed Web Date).
Kicksecure provides a much lower attack surface since there are no open server ports by default unlike other Linux distributions. All unsolicited incoming connections are rejected.
Without TCP ISN randomization, patterns in outgoing traffic can reveal unique characteristics of a system’s CPU, compromising user security. TCP ISN randomization helps preserve security by masking these signals.
You can easily try Kicksecure by using various virtualizers , which enables security compartmentalization by running a Kicksecure VM on top of a Kicksecure host to isolate malware and testing inside the VM.
Kicksecure protects Linux user accounts against brute force attacks by using pam faillock.
Strong entropy is required for computer security to ensure the unpredictability and randomness of cryptographic keys and other security-related processes. Kicksecure makes encryption more secure thanks to preinstalled random number generators.
Booting a VM into Live Mode is as simple as choosing Live Mode in the boot menu. After the session, all data will be gone.
Linux is highly reliable and secure. It is Open Source and freedom paradigm sets it apart from other OS. That's why Kicksecure is based on Linux.
Our website offers an alternative onion version which offers a higher connection security between the user and the server. This is because connections over onions are providing an alternative end-to-end encryption which is independent from flawed TLS certificate authorities and the mainstream Domain Name System (DNS).
Our Firewall is configured specifically for securely using the Internet.
AppArmor profiles restrict the capabilities of commonly used, high-risk applications such as Tor Browser.
Learn more about our Linux User Account Separation .
Kicksecure increases safety by using separate accounts for daily use and admin tasks. This is called user-sysmaint-split. It prevents routine software—like a hacked browser—from gaining full system access or installing rootkits.
To prevent /tmp-based attacks, Kicksecure uses libpam-tmpdir, which creates secure, per-user temporary folders and sets strict permissions. This blocks common threats like symlink exploits.
Kicksecure integrates many of the system hardening practices from the Securing Debian Manual to improve its security posture. Although Debian's manual is older, Kicksecure supplements it with its own research and publishes updated security guidance in its wiki, ensuring users benefit from both foundational and current best practices.
Knowledge is a defense: Explore Kicksecure's comprehensive documentation to strengthen your security posture and reduce vulnerabilities.
Kicksecure provides additional security hardening measures and user education to provide better protection from viruses / malware.
Console Lockdown disables legacy login methods and thereby improves security hardening.
Kicksecure enforces strict file permission settings in /home, automatically removing read, write, and execute access for others during setup or account creation. This prevents users from accessing each other's files and corrects unsafe permissions that may exist from earlier configurations. The approach aligns with hardening principles from the Securing Debian Manual.
To reduce the risk of unintended file exposure, Kicksecure sets a stricter default umask for non-root accounts so that new files are inaccessible to other accounts by default. This enhances security beyond the /home folder, especially in shared areas like folder /var.
In oversimplified terms, Kicksecure is just a collection of configuration files and scripts. Kicksecure is not a stripped down version of Debian; anything possible in "vanilla" Debian GNU/Linux can be replicated in Kicksecure. About Kicksecure
A canary confirms that no warrants have ever been served on the Kicksecure project.
Running low on RAM isn't a security problem. swap-file-creator will create an encrypted swap file.
All the Kicksecure source code is licensed under OSI Approved Licenses. We respect user rights to review, scrutinize, modify, and redistribute Kicksecure. This improves security and privacy for everyone.
Kicksecure is Freedom Software and contains software developed by the Free Software Foundation and the GNU Project.
Research and Implementation Project: Kicksecure makes modest claims and is wary of overconfidence. Kicksecure is an actively maintained research project making constant improvements; no shortcomings are ever hidden from users.
Kicksecure is independently verifiable by security experts and software developers around the world; you don’t have to trust developer claims. This improves security and privacy for everyone.
Kicksecure respects data privacy principles. We don’t make advertising deals or collect sensitive personal data. There are no artificial restrictions imposed on possible system configurations .
The purpose of SUID Disabler and Permission Hardener is to enhance system security. It does this by strengthening the isolation of Linux user accounts, implementing stricter file permission settings, and decreasing potential security vulnerabilities by turning off SUID-enabled binaries.
A secure by default operating system with the latest security research in place.
At
Kicksecure we value freedom and trust, supporting Open Source and Freedom Software
2012-
2025 ENCRYPTED SUPPORT LLC
We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!