oxeo0/opsec-blogposts
1
0
Fork 0
mirror of http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/opsec-blogposts.git synced 2025-06-08 03:09:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

update the kicksecure tutorials to include how to setup the host OS

Browse source
This commit is contained in:
nihilist 2025-05-24 21:44:04 +02:00
parent e2cd8d43d1
commit d83710b817
16 changed files with 62 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

18
sensitivevm/index.md
View file

@ -359,6 +359,7 @@ Which after tweaking it accordingly we end up with the following reboot script:
[user ~]% vim reboot.sh
[user ~]% cat reboot.sh
#!/bin/bash
# turn off display
@ -382,7 +383,22 @@ Which after tweaking it accordingly we end up with the following reboot script:
# reboot the host OS
/usr/bin/sudo /usr/sbin/reboot now
Now here if the host OS user has a password set like we setup in the [Host OS tutorial](../linux/index.md), we need can either remove the user password like so:
![alt text](image.png)
OR we can simply use visudo to set the NOPASSWD on the commands we want to run (that normally require a sudo password) to avoid having to type the sudo password to run them:
```sh
[user ~]% sudo visudo
# User alias specification
user ALL=(ALL) NOPASSWD:/usr/bin/systemctl, /usr/bin/zuluCrypt-cli, /usr/sbin/reboot, /usr/bin/virsh
```
And with this we're all set to use the emergency reboot script without having to type the sudo password.
Even in a deniability setting, having this script sit in your home directory doesn't incriminate you either, **because you can tell the adversary that this script is used to prevent someone else from seeing that you're watching the non-sensitive content (such as adult content) that is sitting in the encrypted volume.** Still this is a plausible explanation that makes it look like you are cooperating to the adversary when you are being asked about that script in particular.