Introduction[edit]

This is a pre-release. (What does that mean?)

An existing Debian version 11 (codename: bullseye) installation can be converted into Kicksecure ™ by installing a Kicksecure ™ deb package. This procedure is also called distro-morphing.

There is no downloadable iso yet but it will be available in the future. In the meantime install Debian on the host or inside a VM, then install Kicksecure ™ on top.

To increase the chances of success, it is best to start with a minimal installation either,

A) graphical user interface (GUI) Xfce
B) or command line interface (CLI)

and then install a Kicksecure ™ meta package as documented below.

It is easiest to set the Linux user account name to user during the installation of Debian bullseye.

Prerequisites[edit]

1. Essentials.

The user needs to verify that the following prerequisites are met.

Debian bullseye installed.
User account user exists.

2. Gain administrative (root) rights. ^[1]

Becoming root is required because the following commands need to be run with administrative (root) rights as documented below. ^[2]

A) Debian: Use su as documented below.
B) Most Qubes users: same as above.
C) Advanced Qubes users: If using a Debian minimal template or not having the passwordless-root package installed, see footnote. ^[3]

Run the following command in a terminal.

su

3. Install sudo and adduser package.

1. Update the package lists.

apt update

2. Upgrade the system.

apt full-upgrade

3. Install sudo and adduser package.

apt install --no-install-recommends sudo adduser

5. Create group console.

/usr/sbin/addgroup --system console

6. Add user user to group console.

/usr/sbin/adduser user console

7. Add user user to group sudo.

Note:

A) Most users: No special notice.
B) Advanced users: If the user is intending to lockdown user user by not granting root rights, see footnote. ^[4]

/usr/sbin/adduser user sudo

8. Reboot.

/sbin/reboot

Installation[edit]

Add the Kicksecure ™ Signing Key[edit]

Complete the following steps to add the Kicksecure ™ Signing Key to the system's APT keyring.

Open a terminal.

1. Package curl needs to be installed.

Install curl. To accomplish that, the following steps A. to D. need to be done.

A. Update the package lists.

sudo apt update

B. Upgrade the system.

sudo apt full-upgrade

C. Install the curl package.

Using apt command line parameter --no-install-recommends is in most cases optional.

sudo apt install --no-install-recommends curl

D. Done.

The procedure of installing curl is complete.

2. Download Kicksecure ™ Signing Key. ^[5]

If you are using Debian, run.

curl --tlsv1.3 --proto =https --max-time 180 --output ~/derivative.asc https://www.kicksecure.com/derivative.asc

If you are using a Qubes Debian Template, run.

curl --proxy http://127.0.0.1:8082/ --tlsv1.3 --proto =https --max-time 180 --output ~/derivative.asc https://www.kicksecure.com/derivative.asc

3. Users can check Kicksecure ™ Signing Key for better security.

4. Add the Kicksecure ™ signing key to APT's keyring folder. ^[6]

sudo cp ~/derivative.asc /usr/share/keyrings/derivative.asc

5. Done.

The procedure of adding Kicksecure ™ signing key is now complete.

Add the Kicksecure ™ Repository[edit]

Add Kicksecure ™ Repository.

Choose either: Option A, Option B OR Option C.

Option A: Add Kicksecure ™ Onion Repository.

To add Kicksecure ™ Repository over Onion please press on expand on the right.

Install apt-transport-tor from the Debian repository.

sudo apt install apt-transport-tor

Add Kicksecure ™ APT repository for default Kicksecure ™ using Debian stable. At the time of writing this was bullseye.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion bullseye main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Option B: Add Kicksecure ™ Clearnet Repository over Tor.

To add Kicksecure ™ Repository over torified clearnet please press on expand on the right.

Install apt-transport-tor from the Debian repository.

sudo apt install apt-transport-tor

Add Kicksecure ™ APT repository for default Kicksecure ™ using Debian stable. At the time of writing this was bullseye.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+https://deb.kicksecure.com bullseye main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Option C: Add Kicksecure Clearnet Repository over clearnet.

To add Kicksecure ™ Repository over clearnet please press on expand on the right.

Add Kicksecure ™ APT repository for default Kicksecure ™ using Debian stable. At the time of writing this was bullseye.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com bullseye main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Install the Kicksecure ™ Package[edit]

1. Pick a Kicksecure ™ package.

kicksecure-cli: command line interface (CLI) version only. This does not modify the graphical desktop environment. This package provides better kernel hardening, improved entropy, and other security features.
kicksecure-xfce: this is the same as kicksecure-cli but it installs the Xfce graphical desktop environment and default applications. This is useful if Debian was installed without a graphical desktop environment and the Kicksecure ™ graphical desktop environment (Xfce) is desired.
Qubes users:
- kicksecure-qubes-cli
- kicksecure-qubes-gui

2. Install a Kicksecure ™ package such as kicksecure-cli.

Install kicksecure-cli. To accomplish that, the following steps A. to D. need to be done.

A. Update the package lists.

sudo apt update

B. Upgrade the system.

sudo apt full-upgrade

C. Install the kicksecure-cli package.

Using apt command line parameter --no-install-recommends is in most cases optional.

sudo apt install --no-install-recommends kicksecure-cli

D. Done.

The procedure of installing kicksecure-cli is complete.

3. Check APT sources.

Check if some APT sources in /etc/apt/sources.list should be kept.

Move the original /etc/apt/sources.list file out of the way (or delete it) because it is replaced by Kicksecure ™'s /etc/apt/sources.list.d/debian.list.

sudo mv /etc/apt/sources.list ~/

4. Create an empty /etc/apt/sources.list file.

sudo touch /etc/apt/sources.list

5. Optional: Set the onionized Debian repositories.

Follow these instructions if Debian's onion repositories are preferred.

6. Done.

The Kicksecure ™ installation is complete.

Footnotes[edit]

↑ One way or another.
↑
When a user is using su to gain administrative rights, the user is required to use full path to the programs addgroup, adduser, reboot because when using su the PATH environment variable is not adjusted for use with root rights. See echo "$PATH".
echo "$PATH"
user rights PATH printout:
```
/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
```
root rights PATH printout:
```
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
```
By comparison, when using sudo using /full/path/to/application is not required.
↑ A root terminal is required to proceed which can be started from Qubes dom0 terminal as per the Qubes upstream documentation. Unspecific to Kicksecure ™].
↑
The following command /usr/sbin/adduser user sudo grants root rights to user user. If the user intents to use user user without root rights for better security, the user should omit running the /usr/sbin/adduser user sudo and instead, in case of:
- Debian: Use su.
- Kicksecure ™ for Qubes: If not installing the passwordless-root package and/or when distribution morphing a Debian minimal template into Kicksecure ™, root terminal is required to proceed which can be started from Qubes dom0 terminal as per the Qubes upstream documentation. Unspecific to Kicksecure ™].
↑ See Secure Downloads to understand why curl and the parameters --tlsv1.3 --proto =https are used instead of wget.
↑ Placing an additional signing key into folder /usr/share/keyrings by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder /usr/share/keyrings using the signed-by keyword the signing key will be actually used. Therefore deleting keys in /usr/share/keyrings is optional if intending to disable an APT repository. See also APT Signing Key Folders.

Unfinished: This wiki is a work in progress. Please do not report broken links until this notice is removed, use Search Engines First and contribute improving this wiki.

Kicksecure ™ A secure by default operating system with the latest security research in place.

Donate

FREE · PLUS · PREMIUM Support

At Kicksecure we believe in freedom and trust. That's why we fully support Open Source and Freedom Software. Learn more.

Kicksecure ™ is supported by Evolution Host DDoS Protected VPS.

Kicksecure ™ is a secure by default operating system with the latest security research in place.

The personal opinions of moderators or contributors to the Kicksecure ™ project do not represent the project as a whole. By using this website, you acknowledge you have read, understood, and agree to be bound by these these agreements: Terms of Service , Privacy Policy , Cookie Policy , E-Sign Consent , DMCA , Imprint Kicksecure

ENCRYPTED SUPPORT LP, 2022

Kicksecure ™ is Hardened by Kicksecure ™

[1] One way or another.

[2] When a user is using su to gain administrative rights, the user is required to use full path to the programs addgroup, adduser, reboot because when using su the PATH environment variable is not adjusted for use with root rights. See echo "$PATH".
echo "$PATH"
user rights PATH printout:
/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games

root rights PATH printout:

/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

By comparison, when using sudo using /full/path/to/application is not required.

[3] A root terminal is required to proceed which can be started from Qubes dom0 terminal as per the Qubes upstream documentation. Unspecific to Kicksecure ™].

[4] The following command /usr/sbin/adduser user sudo grants root rights to user user. If the user intents to use user user without root rights for better security, the user should omit running the /usr/sbin/adduser user sudo and instead, in case of:
Debian: Use su.

Kicksecure ™ for Qubes: If not installing the passwordless-root package and/or when distribution morphing a Debian minimal template into Kicksecure ™, root terminal is required to proceed which can be started from Qubes dom0 terminal as per the Qubes upstream documentation. Unspecific to Kicksecure ™].

[5] Debian: Use su.

[6] Kicksecure ™ for Qubes: If not installing the passwordless-root package and/or when distribution morphing a Debian minimal template into Kicksecure ™, root terminal is required to proceed which can be started from Qubes dom0 terminal as per the Qubes upstream documentation. Unspecific to Kicksecure ™].

[5] See Secure Downloads to understand why curl and the parameters --tlsv1.3 --proto =https are used instead of wget.

[6] Placing an additional signing key into folder /usr/share/keyrings by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder /usr/share/keyrings using the signed-by keyword the signing key will be actually used. Therefore deleting keys in /usr/share/keyrings is optional if intending to disable an APT repository. See also APT Signing Key Folders.

[1]

[2]

[3]

[4]

[5]

[6]

Install Kicksecure ™ inside Debian

Contents