Hardened Slarpx is an advanced, security-oriented Debian derivative engineered to withstand highly hostile network environments and persistent local threats. It abandons convenience in favor of absolute system integrity. Slarpx operates under the assumption that the system is constantly under attack, deploying stringent defense-in-depth methodologies across the kernel, network stack, package management, and runtime environments.
TARGET AUDIENCE: This distribution is strictly designed for security researchers, extreme threat-model environments, and isolated analytical workstations. It is fundamentally incompatible with daily consumer workloads, standard gaming, or casual browsing.
LIABILITY DISCLAIMER: Slarpx modifies low-level hardware interactions, flushes volatile memory forcefully, and actively self-sabotages user-space processes if it suspects intrusion. By deploying this system, the user waives Nixovena Labs of any liability regarding hardware degradation, catastrophic data loss, or network isolation failures.
Use exclusively at your own risk. Support is not guaranteed for packages outside the minimal core.
Following the graphical installation, it is absolutely critical that the system administrator manually configures and enables UEFI Secure Boot. The Slarpx kernel lock-down mechanisms (integrity/confidentiality modes) rely heavily on the hardware trust anchors provided by Secure Boot.
For comprehensive instructions on establishing Secure Boot keys and enrolling signatures, strictly adhere to the official Debian SecureBoot documentation.
Slarpx installation utilizes a variant of the Debian graphical installer environment.
This section provides a comprehensive technical analysis of the Kernel-level security and networking
hardening measures applied in the HardenedSlarpx distribution. The configurations reviewed orchestrate
one of the most aggressive security baselines available for Linux, closely following the Kernel Self
Protection Project (KSPP) guidelines. The settings span GRUB boot parameters and kernel
sysctl configurations.
File: /etc/default/grub.d/40_cpu_mitigations.cfg
HardenedSlarpx adopts a "security over performance" philosophy. It forces all available hardware and software mitigations for side-channel physical vulnerabilities:
nosmt=force,
hyperthreading is completely disabled on the system. This drastically drops performance but
fundamentally closes the attack vectors for severe cross-thread data leakage exploits (such as L1TF
and MDS).spectre_v2=on, spectre_bhi=on). retbleed=ibpb forces
hardware-level Indirect Branch Prediction Barriers instead of weaker software fallbacks.mds=full,nosmt and tsx_async_abort=full,nosmt. This ensures data processed
cannot be skimmed by other malicious tenant processes.
Files: /etc/default/grub.d/40_kernel_hardening.cfg,
/etc/sysctl.d/sysctl.conf
Exploit mitigation is drastically heightened by destroying predictability and restricting process interactions within kernel space:
init_on_alloc=1 and init_on_free=1
ensures memory is completely overwritten with zeros before being given to or taken back from an
application. It significantly stalls "Use-After-Free" exploit primitives.kernel.randomize_va_space=2). Furthermore, page_alloc.shuffle=1
randomizes physical page allocations, and randomize_kstack_offset=on randomizes stack
offsets on every syscall, making ROP attacks incredibly difficult.slab_nomerge). This
strictly silos cache allocations, meaning an attacker causing a heap overflow in one type of object
cannot easily rewrite adjacent boundaries of another object type.vsyscall=none, vdso32=0, ia32_emulation=0) are permanently
disabled, shrinking the attack surface by discarding aging architecture wrappers heavily favored by
exploit developers.cfi=kcfi) to
structurally validate the destination of indirect branches. Additionally, the kernel electric-fence
feature (kfence.sample_interval=100) catches out-of-bounds heap operations.proc_mem.force_override=never which
prevents an application (or an attacker) from exploiting the FOLL_FORCE flag to overwrite protected
local memory through the procfs interface. BPF is also fundamentally disabled for unprivileged users
(unprivileged_bpf_disabled=1).File: /etc/default/grub.d/40_kernel_hardening.cfg
To neutralize external hardware exploits (e.g. plugging a malicious Thunderbolt/PCIe device to suck keys directly out of RAM):
intel_iommu=on,
amd_iommu=force_isolation). Ensures that device memory mappings are strictly verified.
iommu.strict=1 disables lazy flushing. While
demanding on performance, it ensures old DMA mappings are purged synchronously, meaning physical
devices cannot fetch "stale" data from memory.efi=disable_early_pci_dma severs the
busmaster bit on PCI bridges before the kernel even initializes the IOMMU, closing the temporary
boot-time window vulnerability.Files: /etc/default/grub.d/40_kernel_hardening.cfg,
/etc/default/grub.d/41_recovery_restrict.cfg, /etc/sysctl.d/sysctl.conf
Once compromised, it is better for the machine to stop than to serve the attacker:
oops=panic,
panic_on_warn=1, and panic_on_oops=1, the kernel will instantly panic and
shutdown if it detects a serious internal error or an execution path warning—classic indicators of
memory corruption exploits in progress.
panic_on_taint=0xC0924 parameter forces
the machine to halt if out-of-scope hardware, firmware bugs, or debug mutating events are loaded.
lockdown=integrity mode,
stripping root's ability to modify kernel space memory or execute raw port operations, preventing
lateral movement from userland root to ring-0.File: /etc/sysctl.d/sysctl.conf
An exhaustive networking clampdown designed to deter Man-in-the-Middle (MitM), Spoofing, and Denial of Service (DoS) attacks:
rp_filter=1) validates
that the source IP comes from the logical corresponding interface. ARP gratuitous updates and
ignores are tuned to block MAC-address spoofing and poisoning.random.trust_cpu=off) and bootloader Random Number Generators, insisting the Linux
kernel mixes its own cryptographic entropy.ipv6.disable=1 is injected into GRUB to reduce the vast
attack surface of the IPv6 networking stack if it is not strictly required.The network hardening architecture in HardenedSlarpx utilizes a dual approach: a highly restrictive
ingress/egress firewall (nftables) and an immutable, enforced DNS management system. This
strategy is designed to protect against internal data exfiltration, thwart local network attacks, and
deter broad-spectrum Internet reconnaissance.
File: /etc/nftables.conf
Unlike typical desktop firewalls that only block incoming traffic, HardenedSlarpx dictates a strict
"Default Drop" policy on both incoming (input) and outgoing
(output) chains. This serves as a significant hurdle for malware looking to communicate
outside the local machine.
Key Ingress (Incoming) Protections:
Key Egress (Outgoing) Protections:
1.1.1.1 and Quad9 9.9.9.9).File: /etc/systemd/system/slarpx-dns.service
Purpose: It is a common vulnerability on modern operating systems that DHCP assignments,
local routers, or Network Management daemons will automatically overwrite /etc/resolv.conf,
effectively intercepting the user's DNS queries. HardenedSlarpx resolves this via a dedicated systemd
service.
slarpx-dns service runs at boot
up, immediately enforcing a static DNS configuration by completely overriding the local resolver. It
then relies on the CAP_LINUX_IMMUTABLE capability to run the chattr +i
shell command, applying an immutable file tag to /etc/resolv.conf./etc/resolv.conf, the daemon executing it is strongly sandboxed contextually
by systemd. It drops access using NoNewPrivileges=yes,
PrivateDevices=yes, and MemoryDenyWriteExecute=yes to ensure the script
itself cannot be co-opted.
The HardenedSlarpx distribution utilizes three powerful, custom backend security engines (daemons) designed to protect the operating system's security and integrity. These engines ensure the system is protected against various threat vectors: Poison (Timing Disruption), Silencer (Information Leak Prevention), and Xennytsu (Advanced Behavioral Analysis & EDR).
Purpose: Instead of completely blocking malicious or suspicious process attempts, this engine actively disrupts them by dynamically slowing them down. This approach is generally used to sabotage buffer-overflow or race conditions that exploits rely on.
fanotify
infrastructure to monitor file operations across critical paths and temporary working directories.
tmpfs root, or if its parent is a suspicious scripting language.usleep() pause right before a
file read operation takes place. These tiny slowdowns do not crash the system, but they cause
suspicious payloads to hit timeouts or break the connection.systemd,
dbus) and common user applications are exempt from this delay process, ensuring
day-to-day performance is not degraded.
Purpose: Limits privilege escalation vulnerabilities in the system environment and prevents reconnaissance operations where an attacker or malicious application tries to gather information about the system.
/proc directory with the
hidepid=invisible option. When any unprivileged user runs tools like ps or
top, they cannot see the processes belonging to other users.
/proc/sys/kernel/, such as yama/ptrace_scope,
kptr_restrict, and dmesg_restrict. It continuously checks these settings
in a loop. If an attempt is made to alter them, it immediately reverts them back to their secure
states.
/boot directory and kernel module
build paths from ordinary users. It also revokes world-readable status from logs inside
/var/log.
gcc, gdb, strace, nmap, and
tcpdump which an attacker could use for lateral movement within the system.
Purpose: Acts as an ultra-low-footprint, modern EDR mechanism. By analyzing the
operating system, process trees, and memory in real-time, it instantly detects malicious activities and
ruthlessly kills the process with a hardware SIGKILL.
cmdline) to instantly detect if a command is attempting to open a reverse shell.
Furthermore, it is capable of identifying the execution of base64 encoded payloads by format./proc/pid/maps) of running processes. It spots anonymous executable
regions or fileless rootkit/shellcode traces loaded into memory, scoring them highly for immediate
destruction.LD_PRELOAD and LD_LIBRARY_PATH./bin/bash suddenly spawning from under nginx is highly
suspicious. Xennytsu utilizes a hierarchical inspection mechanism that terminates the process the
moment a threat score exceeds 70.The HardenedSlarpx distribution implements a robust, multi-layered "Defense in Depth" strategy by hardening various aspects of the operating system configuration. The hardening configurations are deeply embedded within the system's package management, hardware modules, user environments, physical access vectors, and boot/shutdown processes.
seccomp-bpf sandbox, which limits the system calls the process can make. Moreover, the
download operations are executed by the unprivileged _apt user rather than
root.
.deb files) are automatically
cleaned after installation to save space and reduce local tampering risks.jitterentropy_rng module is forcefully loaded
on boot, guaranteeing a strong, non-deterministic source of random numbers (entropy) which is
critical for early-boot cryptographic operations.Privacy=network/on), making it exceptionally difficult to track the device based on
its Bluetooth MAC address.HISTFILE=/dev/null and wiped at exit) preventing local attackers from uncovering
sensitive commands. Idle sessions are automatically terminated after 15 minutes of inactivity.umask 077 is enforced, meaning any
new file or directory created by a user is strictly private (readable/writable only by the owner).
core 0), ensuring application crashes don't leak physical
memory/passwords to the disk. Stack sizes are limited to help mitigate buffer overflow attacks.gcc, make, cc), stopping local
attackers from compiling rootkits or local exploits on the machine.faillock, user accounts are
temporary locked for 5 minutes after 5 consecutive failed authentication attempts.umask=0077 applies to files created via sudo.use_pty),
neutralizing terminal hijacking exploits. It also requires an actual TTY context
(requiretty).sudo passwords is significantly shortened to 2 minutes.
All environmental variables are fully stripped, maintaining only a secure binary executable path.