systemcheck - Security Check Application
Donate
Connectivity Test. Sanity Test. Update Check. And More.
Introduction
[edit]systemcheck is a script which checks numerous, important system variables. systemcheck can be run in a CLI environment (such as in terminal emulator xfce4-terminal) or via the GUI option, which has an in-built progress meter and summary notification popup of the results. The script is stored in the /usr/bin/systemcheck and /usr/libexec/systemcheck/ directories. Kicksecure is functional without the systemcheck script since it only checks the system status; it is not responsible for core settings. Nothing is compiled, and the script can be easily inspected in the source code.
The systemcheck script was inspired by browser based check websites.
Browser based check websites are useful for very specialized checks, but Kicksecure is a complete operating system. This means certain checks can be performed, otherwise a user's security might be endangered.
systemcheck allows the entire Kicksecure community to stay informed about important updates or advice, and this is particularly important for users who might not start the browser or visit the Kicksecure website regularly.
Running systemcheck
[edit]systemcheck verifies that the Kicksecure system is up-to-date and that everything is in proper working order.
Follow the steps below to manually run systemcheck and check the system status.
How-to: Manually Run systemcheck
[edit]If you are using Kicksecure for Qubes, complete the following steps. [1]
Qubes App Launcher (blue/grey "Q") → click the M you want to check → System Check
If you are using a graphical environment, complete the following steps.
Start Menu → System → systemcheck
If you are using a terminal environment, complete the following step. systemcheck
Depending on system specifications, systemcheck can take up to a few minutes to complete. If everything is working as intended, the output should highlight each INFO heading in green (not red). A successful systemcheck process will have output similar to below.
Sample systemcheck Output
[edit][INFO] [systemcheck] Kicksecure | Kicksecure kicksecure-17 TemplateBased AppVM | Sun 25 Apr 2021 07:56:41 AM UTC [INFO] [systemcheck] Connected to Tor. [INFO] [systemcheck] Kicksecure APT Repository: Enabled. When the Kicksecure team releases BUSTER-PROPOSED-UPDATES updates, they will be AUTOMATICALLY installed (when you run apt full-upgrade) along with updated packages from the Debian team. Please read https://www.kicksecure.com/wiki/Trust to understand the risk. If you want to change this, use: <code>sudo repository-dist</code> [INFO] [systemcheck] Debian Package Update Check: Checking for software updates via apt... ( Documentation: https://www.kicksecure.com/wiki/Update ) [INFO] [systemcheck] Debian Package Update Check Result: No updates found via apt. [INFO] [systemcheck] Please donate! See: https://www.kicksecure.com/wiki/Donate
Tor Bootstrap
[edit]Tor bootstrap refers to the process of attempting to connect to the Tor network (successfully or unsuccessfully). Familiar output related to this process includes: "Tor connecting xx percent...", "Tor not connected", "Tor connected" and so on. Bootstrapping does not refer to related concepts, such as whether connections are "secure", "not secure", "anonymous" or "not anonymous".
autostart systemcheck
[edit]Perform these steps to automatically start systemcheck; this step is optional.
1. Create folder ~/.config/autostart.
mkdir -p ~/.config/autostart
2. Create a symlink from /usr/share/applications/systemcheck.desktop to ~/.config/autostart/systemcheck.desktop.
ln -s /usr/share/applications/systemcheck.desktop ~/.config/autostart/systemcheck.desktop
3. Done.
systemcheck will now automatically start after boot.
System Checks
[edit]In all the checks below, systemcheck warnings appear if a problem is detected. Conversely, systemcheck output is otherwise quiet unless using the --verbose option. Any operating system updates, downloads or other network activity are Tor stream-isolated by default.
| Check | Description |
|---|---|
| Canary | An automated Kicksecure warrant canary check is available with the --verbose parameter, see: Warrant Canary Check.
|
| Clock Source | Check if the clock source is KVMClock and warn if that is the case. [2] |
| Entropy Test | An entropy availability check confirms /proc/sys/kernel/random/entropy_avail contains no less than 112 bytes. |
| Hostname | Check if:
(Relevant inside Whonix® only.) |
| IP Address Routing | Whonix only: Check if IP forwarding is disabled on Whonix-Gateway. |
| Connectivity Tests | When using --ip-test (previously called, same as --leak-tests):
Checks if |
| Log Inspection | When using the --verbose option, check if ~/.msgcollector/msgdispatcher-error.log exist and report this if confirmed.
|
| Meta-package Check | Check if the relevant meta-packages [3] are installed on Kicksecure. Also see: Kicksecure Debian Packages. |
| Network Connection | Check setup-dist has properly configured networking. |
| Operating System Updates | apt update is run through a separate APT SocksPort for stream isolation. A notification is provided whether the system is up-to-date or requires updating. |
| Package Manager | Check if a package manager is currently running and wait until the process is finished. [4] This prevents connection failures during concurrent upgrades of the Tor package. |
| Tor | Check:
|
| Repository Notification | Notifies whether Derivative APT Repository is enabled or not. |
| Stream Isolation (Whonix only) | When using --ip-test (previously called, same as --leak-tests):
A stream isolation test checks the IP addresses from (1) and (2) differ. |
| Tor Bootstrap | Tor Bootstrap Status:
|
| Miscellaneous |
|
| Virtualization Platform | Check Kicksecure is being run on one of the supported virtualizer platforms, including VirtualBox, KVM or Qubes. |
| su access check | Checks if su is locked down so only root an use su. [7] |
| Unwanted Packages Check | See Unwanted Packages Check. |
| Physical Security Check | See Physical Security Check. |
Update Notifications by updatecheck
[edit]Figure: updatecheck notification (passive popup)
Platform specific.
- Kicksecure: Applicable. See below.
- Kicksecure for Qubes: Not applicable, because Qubes has its own updater, which is documented on the Operating System Software and Updates wiki page.
Runs approximately every 6 hours.
Features:
- Passive popup.
- Wait for a good time to run the update check.
- Waits 2 minutes after boot before checking for updates, to give the user a chance to run APT before the package database gets locked. Updatecheck runs APT, which locks the package database as it updates it.
- Runs leaprun onion-time-pre-script up to 5 times until it succeeds. Waits 2 minutes between each call if it fails. This is to ensure Tor bootstrap has been completed.
- Waits up to 6 minutes for sdwdate to complete time synchronization.
- Waits up to 20 minutes for the package database to be unlocked, which means no other APT process (run by the user) is currently locking it.
- Stale notifications are cleared. If there was an issue upgrading but not when updatecheck runs again, the stale, no longer applicable notification will be cleared to avoid confusion.
Note: No administrative ("root") rights required. Do not use sudo!
Check logs.
journalctl --boot --user -u updatecheck.service
Check status.
systemctl --boot --user status updatecheck.service
Disable.
systemctl --user mask updatecheck.service
Re-enable.
systemctl --user unmask updatecheck.service
Information for developers: See wiki page Dev/Automatic Updates chapter updatecheck.
updatecheck for accounts other than user
[edit]updatecheck starts automatically when a normal user logs in graphically into a normal desktop. This is triggered by the file /etc/xdg/autostart/updatecheck.desktop. This is only expected to happen if the system is booted in PERSISTENT mode - USER session or LIVE mode - USER session. This means all normal user accounts will automatically have updatecheck working for them.
When user-sysmaint-split is installed, the sysmaint user account will only be able to log into a sysmaint graphical session, and only when the system is booted into a SYSMAINT session. The sysmaint graphical session is not a normal desktop, and it does not automatically run all of the services configured in /etc/xdg/autostart. This means updatecheck will not run in a sysmaint session.
Physical Security Check
[edit]Figure: systemcheck - Physical Security Check
Several checks related to Protection Against Physical Attacks.
- Login security check:
- Checks if all Linux user accounts have a password set or if it is absent.
- Checks if all Linux user accounts have a autologin set or if it is absent.
- Whether Full Disk Encryption (FDE) is enabled or disabled.
- Whether the GRUB boot menu is protected by a Bootloader Password.
Checks not included:
- BIOS Password check. Operating systems do not have permission to detect if a BIOS password is set or absent.
Unwanted Packages Check
[edit]Unwanted packages systemcheck will warn against.
systemcheck default configuration file /etc/systemcheck.d/30_default.conf
contains several configuration directives systemcheck_unwanted_package.
At time of writing, these are packages associated with privacy issues or deprecated packages.
Version Numbers
[edit]
Build Version
[edit]
- Build version never changes: The Kicksecure build version - the version number of the Kicksecure build - is immutable, similar to a date of birth. It does not change and is not supposed to.
-
Version embedded at build time: When the image is created, the current Kicksecure version number is embedded in it. This allows
systemcheckto determine which build script version was used. - Static for diagnostics: The version number remains fixed and is not affected by updates. It is mainly relevant to older build script versions and is useful for diagnostics. Deprecated builds may be announced if upgrading becomes too difficult or costly. In such cases, we intent to use systemcheck or dismissable one time popups to informs users.
- Non-upgradable build version numbers: Build version cannot be upgraded. This is by design.
- Generally not important for users: Unless instructed otherwise by documentation or developers, users typically do not need to worry about the build version.
- Updates remain possible: Standard ("everyday") updates can still be installed.
- Release upgrades remain possible: Even Release Upgrade are typically possible when announced via Kicksecure News. So Follow Announcements.
- See also: Update vs Image Re-Installation.
Check Version
[edit]To check the current Kicksecure version, run the following command:
systemcheck --verbose --function show_versions
The output should be similar to the following, depending on the platform.
Non-Qubes:
[INFO] [systemcheck] Kicksecure build version: 17.4.4.6 [INFO] [systemcheck] kicksecure-dependencies-cli: 31.5-1 [INFO] [systemcheck] derivative_major_release_version /etc/kicksecure_version: 17
Qubes:
[INFO] [systemcheck] Kicksecure build version: 3:10.2-1 [INFO] [systemcheck] kicksecure-dependencies-cli: 31.5-1 [INFO] [systemcheck] derivative_major_release_version /etc/kicksecure_version: 17
Technical Details
[edit]For advanced users only.
The dist-base-files
package contains the script dist-base-files.postinst, which essentially runs:
echo "$dist_build_version" > "$build_version_file"
Platform-specific details:
- For non-Qubes, this corresponds to the derivative-maker Git tag version used to create the image.
- For Qubes, the following command is executed during the initial installation of
dist-base-files
zless /usr/share/doc/dist-base-files/changelog.Debian.gz | dpkg-parsechangelog -l- -SVersion
Warrant Canary Check
[edit]Introduction
[edit]
Prerequisite knowledge: Kicksecure warrant canary.
There are several reasons an Automated Warrant Canary Check is justified:
- The Kicksecure warrant canary has limited utility if it is forgotten over time and not regularly verified.
- It is unlikely the Kicksecure warrant canary is routinely verified by the community.
- If a community member discovers the Kicksecure warrant canary verification has failed, there is no effective way to notify all Kicksecure users.
Features
[edit]| Feature | Description |
|---|---|
| Function | Functions similarly to an update check but determines if the Kicksecure warrant canary is still valid. |
| Security |
|
| Implementation details |
|
| Verbose parameter | During the initial deployment phase of this new feature, systemcheck will only show canary status information when using the --verbose parameter. The reason is that there might be non-security-related potential bugs to address:
|
| Troubleshooting | In case of issues, manually verify the Kicksecure warrant canary. Also see: Whonix Warrant Canary Forum Discussion
|
Disable Warrant Canary Check
[edit]
This disables automated verification of the Kicksecure warrant canary when running systemcheck.
This will prevent the daily Kicksecure census.
Open file /etc/systemcheck.d/50_user.conf in an editor with root rights.
Select your platform.
See Open File with Root Rights for detailed instructions on why using sudoedit improves security and how to use it.
Note: Mousepad (or the chosen text editor) must be closed before running the sudoedit command.
sudoedit /etc/systemcheck.d/50_user.conf
Notes:
- When using Kicksecure-Qubes, this must be done inside the Template.
sudoedit /etc/systemcheck.d/50_user.conf
- After applying this change, shut down the Template.
- All App Qubes based on the Template need to be restarted if they were already running.
- This is a general procedure required for Qubes and is unspecific to Kicksecure-Qubes.
Notes:
- This is just an example. Other tools could achieve the same goal.
- If this example does not work for you, or if you are not using Kicksecure, please refer to Open File with Root Rights.
sudoedit /etc/systemcheck.d/50_user.conf
Add the following content.
canary=false
Arg Max Check
[edit]Only useful in case of systemcheck GUI issues.
systemcheck --function check_arg_max
Expected result:
[INFO] [systemcheck] ERROR: ARG_MAX exceeded!
debug information:
output_func was called with too many arguments.
${FUNCNAME[0]}: output_func
${FUNCNAME[1]}: output_func_cli
${FUNCNAME[2]}: check_arg_max
${FUNCNAME[3]}: systemcheck_run_function
${FUNCNAME[5]}: systemcheck_main
${FUNCNAME[6]}: main
$0: /usr/libexec/systemcheck/systemcheck
The output message will probably be improved in the future. "ERROR: ARG_MAX exceeded!" will be rewritten to "ARG_MAX detected.".
Related
[edit]See Also
[edit]Footnotes
[edit]- ↑
Qube Manager→right-click the VM you want to check→select "Run command in qube"
Type each command below, followed by theENTERkey. xfce4-terminal-emulator systemcheck - ↑ This is only expected to affect those following the KVM instructions.
- ↑ These capture packages which depend on all other recommended / default-installed packages.
- ↑ Otherwise, eventually the system is locked or the package manager is left in a broken state. Advice is provided on what to do in such circumstances.
- ↑
Some users may wonder why it is necessary to check the IP address if the Kicksecure design ensures that the real IP cannot be leaked. Sometimes
check.torproject.orgreports false positives and fails to detect Tor exit nodes, so it is better to provide information about that possibility. This also reduces support requests and bad press. Users are welcome to investigate a Tor exit node that could not be detected, but it can be stated with high confidence that the IP address will be associated with a known Tor exit node. - ↑
Another reason to perform this check is because some users set up dangerous and/or unsupported configurations, such as:
- Using virtualizers which are entirely unsupported and untested by Kicksecure developers.
- Installing arbitrary packages on Kicksecure (
kicksecure-17). This could theoretically create leak vectors, and systemcheck is the last layer of defense against such issues.
- ↑
systemcheck --function check_su_access --verbose
[INFO] [systemcheck] su access check: Locked down - only account root can use su. See also: https://www.kicksecure.com/wiki/Dev/Strong_Linux_User_Account_Isolation#su_restrictions
- ↑ For convenience, the clearnet link (unused by systemcheck) can be previewed here: https://download.kicksecure.com/developer-meta-files/canary/canary.txt.embed.sig
- ↑ sudo -u canary signify-openbsd -V -e -p /usr/share/repository-dist/derivative-distribution-signify-key.pub -x /var/lib/canary/canary.txt.embed.sig -m /var/lib/canary/canary-unembed.txt
A secure by default operating system with the latest security research in place.
At
Kicksecure we value freedom and trust, supporting Open Source and Freedom Software
2012-
2025 ENCRYPTED SUPPORT LLC
We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!