Viotex

History and motivation

The HOST system was developed because of two main reasons, we believe motivate any great product: tough circumstances, no working alternatives and the need to scratch our own itch. 🙂

So it all began when we had faced two major obstacles:

COVID

During early 2020 we were a company that had no home office policy and had no plans to implement it. Also we didn’t expect that COVID will cause more than a week or two without offices and face-to-face meetings.

Privacy sensitive customers and projects

We were working on some cyber-security projects that require special attention to customer’s sensitive data and we had implemented pretty strict policy on how to handle that.

Every obstacle is an opportunity

And we used the that we had:

Experience with customization of Linux

Most of our team is built of Linux enthusiast and we’ve built products on top of customization Linux OS.

Passion for OS hardening

Due to our passion for Linux and history of projects we’ve built a good knowledge base of tools and methods to harden the operating system, especially Linux-based systems.

So …

Having said all of the above about a week before the COVID close down we had to implement a way to:

• continue work in home office environment
• keep as much as possible our strict security policy

Main features

• VPN

Having a home office setup is unimaginable without VPN setup. We use OpenVPN setup with some extra customization like Password protected key plus OTP authentication for a good level of security.

• Own Private Cloud

Any company private LAN requires some solution for internal “cloud” for sharing files, messages and all kind of collaboration software. Our current solution utilizes NextCloud, being a mature framework for collaboration software.

• No Trace solution for sensitive data

As additional but important feature to our solution we were communicated that in some setups it might be interesting that in certain situation the user of Home Office Secure Terminal to securely delete all possible traces of user activities and company sensitive data.

Use cases

This is a Privacy First Product so it’s suitable for everyone, protective or paranoid about their data

• Government organizations
• Non-profit organizations
• Corporations
• Investigative media
• etc

Build your own HOST

The main pieces of the puzzle to customize the system to serve as HOST

Base

Currently we’re basing on a Linux operating system OpenSUSE Micro OS, but similar solution can be implemented for other operating systems like OSX or Windows, via Virtual Machine technology We base our system on openSUSE’s MicroOS for three main reasons

• The MicroOS is transactional, because the system can be done automatic and on problem revert to previous snapshot
• The MicroOS provides flavours, which allow the possibility to produce customizable installation
• Based on OpenSUSE Kalpa Desktop distro, using KIWI NG we generate the base image for the system, which gives us the opportunity to have stable KDE based desktop and still allow customization of the system
• When it comes to customization we use the combustion feature of the MicroOS, that allows to configure the system on first boot of the system. We use that feature to define a custom first-boot application that runs our personalization utility.
• RAM File System overlay. User owned directories have a base overlay that’s copied to a RAM disk partition, so no operative data is saved on the solid drive, after restart or shutdown

    First we start with default user with admin rights, which performs the First boot customization. The scenario is that on first boot of the system the sysadmin and the target user sit side by side and configure the personal HOST system

Next step would be to start the network and begin customization. Bellow we show some steps illustrated with screenshots.

Boot

Obviously we need protection of the operating system software integrity and data starting from boot phase.

• GRUB and LUKS
  • Grub entries are admin password protected
  • Root partition is encrypted with LUKS passwords, one of them is available to the user of the system, the other is used by the administrator

Customization

We do customize for each user the setup based on some pre-configured profiles, using a customization application, that starts on first boot.

Customization is done mainly by our own personalization application, from the installation media and started on first boot.

• Profiles of software per department
  • We’ve pre-prepared groups of applications and libraries that each department needs, those include zypper packages, flatpacks, plasmoids etc.
• Networking and VPN settings
  • Initial networking configuration that the terminal can operate within our company LAN and personal VPN configuration applied
• Personal preferences
  • Specific applications and files will be added in the user overlay

Secure and convenient

During the implementation we always try to keep in mind two conflicting goals. The HOST system MUST be secure and hardened as much as possible, and at the same time convenient in a way that after a user starts up the computer and to be able to do one’s job in a fast manner. It might be the case that someone uses the system not during a regular home office day, but also occasionally being on vacation.

So we took care to have:

• Separate profiles for web browsing
• Internal company profile with privacy-oriented customizations
• Persistent storage for Custom files and Directories

This is important convenience since once a user is logged in certain web or intranet systems we provide the ability to keep one’s sessions for as long as possible as if a “regular” laptop is used, of course with the important note that this is possible after VPN login and synchronization with the company cloud.

• KWallet Keeps user passwords
• Cookies for specific apps
• Bash history
• etc

We support also call for help from your sysadmin

• Specific user application enables reverse SSH tunnel for the company sysadmin to connect and assist

HOST is happy like a Goldfish

HOST is a system that one is happy to use under any circumstances, since the user isn’t concerned about securing sensitive data.

• Doesn’t keep any private info when turned off
  • user directories mount on RAM disk
• KWallet or KeePass kept on Nextcloud so no sensitive traces on the laptop
• VPN OTP
  • Authentication with VPN server always via OTP

HOST plays possum

What we consider probably a bit exotic feature of the HOST system is its ability to be able to wipe any trace of the personalization of the system, so even if the system gets stolen and encryption broken one won’t be able to retrieve any sensitive data about the company or user.

HOST can play useless like a dead Opossum and this is another happy feature of the system

• Special feature when you want to wipe out user configuration by:
  • Bringing signal to drop VPN configuration. This is actually the first step. It’s a shoot and forget message to internal service without waiting for an acknowledgement, and then continue with wiping out the overlay
  • Removing traces by securing deleting a file from the SSD the user overlay

Where do we go from here

There are multiple ideas for adding more features to system’s security and usability but for now we’re working in two main directions.

• Bluetooth assisted authentication
  • Boot disk unlocking and other authentication done via mobile assisted application, inspired by solution similar to UltraBlue
• Dashboard Administrator System for:
  • Massive installation image building using company platform for customization per department
  • Monitoring and incidents handling of HOST terminal

Questions?

We will be happy to get feedback with similar projects, alternative use cases or important issues we might have missed or may consider handling in future.