VaeVictis OS: hardened Debian for people leaving Windows

vaevictis login: guest · why it existsEsc · back to the menu

Most people meet Linux as something to learn and harden by hand. VaeVictis starts from the other end: the protections are on from the first boot.
[ OK ]Disk encryption. A lost laptop is just a lost laptop.
[ OK ]Firewall. Nothing on the network can open a connection to your PC.
[ OK ]Integrity monitor. A popup when programs, services or accounts change.
[ OK ]VPN kill switch. If the tunnel drops, programs on this PC cannot send outside it. Not covered yet: virtual machines, and a reconnect that fails. Tested on real hardware.
[ OK ]Panic button. One click: network off, PC off.
[ OK ]Snapshots. Roll the system back if an update breaks something (kernel updates not covered yet).
[ OK ]Simple apps. Music, Paint with screenshots, PDF, LibreOffice. No terminal needed.
[ OK ]No telemetry. Only security updates and the clock talk to the internet.

guest@vaevictis:~$

vaevictis login: guest · screenshotsEsc · back to the menu

Real screenshots of an installed VaeVictis OS 1.0, not mock-ups. Click one to see it full size.

VaeVictis VPN manager with the tunnel up and the kill switch on, the Panic Mode window and the integrity monitor dashboard — **Security tools.** WireGuard manager with kill switch, the panic button and the integrity monitor dashboard.

Aurora music player playing a track, with a real-time audio spectrum — **Aurora.** A simple music player with a real-time spectrum. It uses no network.

LinPaint+ editor with its Screenshot menu open: full screen, select area and delay — **LinPaint+.** A Paint-style editor that takes screenshots you can edit right away.

The wallpaper. The red logo on a dark circuit pattern.

guest@vaevictis:~$

vaevictis login: guest · download and verifyEsc · back to the menu

vaevictis-gnome-1.0.1.iso · 1.8 GB · 64-bit PC, BIOS or UEFI · 4 GB RAM · 20 GB disk
[ OK ]Immutable release. Published on GitHub as an immutable release: the file cannot be replaced, not even by the author.
[ OK ]Checksum (SHA-256). 2122827a372375b754f87ddb70dab1be916423210156d2f7ae5457909b4a38b2
[ NOTE ]Security release. 1.0.1 fixes three problems found in an audit of the installer. Installed 1.0? Run the four commands of the notice.
[ LIMIT ]Secure Boot. Not supported yet: switch it off in your firmware settings.
Try the live session first: nothing on your disk changes until you install.

Download the ISO Checksum file Release page

# in the folder where you downloaded both files
$ sha256sum -c vaevictis-gnome-1.0.1.iso.sha256
vaevictis-gnome-1.0.1.iso: OK

The checksum is published in two independent places, this page and the GitHub release: compare them. On Windows: certutil -hashfile vaevictis-gnome-1.0.1.iso SHA256.
Then write it to a USB stick of 4 GB or more (it will be erased) with balenaEtcher, dd, or the guarded vv-usb tool from the repository.
Coming next: a GPG-signed SHA256SUMS and a fast mirror at download.vaevictisos.org.

guest@vaevictis:~$

vaevictis login: guest · honest limitsEsc · back to the menu

[ LIMIT ]Not anonymous. There is no Tor routing. For anonymity, use Tails.
[ LIMIT ]No Secure Boot yet. Turn it off in your firmware to boot VaeVictis.
[ LIMIT ]/boot is not encrypted. Someone with your PC in hand could tamper with it.
[ LIMIT ]An alarm, not a wall. The integrity monitor detects changes; it cannot stop an attacker who is already root.
[ LIMIT ]RAM is not wiped. The panic button is fast, not forensic-proof.
[ LIMIT ]One person’s project. Tested on real and virtual machines, never audited by a third party.
The full list is in the threat model. To see which protection does what, try the scenarios.

guest@vaevictis:~$

vaevictis login: guest · community and sourceEsc · back to the menu

[ OK ]Source code. Plain shell, Python and Go on GitHub. Read what runs on your PC.
[ OK ]Hardware reports. Tell us how it runs on your PC, even if everything works.
[ OK ]Security issues. Report them privately, as SECURITY.md explains.
[ OK ]Signed APT repository. apt.linuxtuts.online, key 0A41 158C 1DD6 718D 3D3F FED0 6848 6B39 B2A9 9993.
Tutorials and the full project page live on LinuxTuts. Contact: admin@vaevictisos.org

guest@vaevictis:~$

VAEVICTIS OS 1.0.1