sysmaint - System Maintenance User

Kicksecure ™

Download

On Computer USB Installation Debian morph to Kicksecure Windows (VM) Linux (VM) Mac (VM) VirtualBox (VM) KVM (VM) Qubes (VM) More options Source Code

About

Overview Features Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

• Default Passwords
• Passwords
• User Management
• Login
• Login Spoofing
• Safely Use Root Commands
• sysmaint user
• Protection against Physical Attacks
• User Account Isolation (developers)
• user-sysmaint-split (developers)

There are two accounts.

• user - For daily activities.
• sysmaint - For system maintenance administrative activities such as installing software, upgrading.

This is a security feature. (rationale)

Introduction

sysmaint - system maintenance

Status

Warning: This is for testers-only!

Documentation for this is incomplete. Contributions are happily considered! See this for potential alternatives.

Default Installation Status

• Old versions: Kicksecure build versions up to 17.2.8.5 will not be upgraded to install user-sysmaint-split by default. Users however can opt-in to install it, see #Installation. The package will likely get installed by default when major Release Upgrade to version 18 is performed.
• New versions:
  • host: Meta package kicksecure-host-xfce will come with user-sysmaint-split by default.
  • CLI: Meta package kicksecure-host-cli will not come with user-sysmaint-split by default.
  • servers: user-sysmaint-split will not be installed by default on servers.
  • Distribution Morphing: Depending on chosen meta package.

Installation

Install package(s) user-sysmaint-split sysmaint-panel following these instructions

1 Platform specific notice.

• Kicksecure: No special notice.
• Kicksecure-Qubes: In Template.

2 Update the package lists and upgrade the system .

sudo apt update && sudo apt full-upgrade

3 Install the user-sysmaint-split sysmaint-panel package(s).

Using apt command line --no-install-recommends option is in most cases optional.

sudo apt install --no-install-recommends user-sysmaint-split sysmaint-panel

4 Platform specific notice.

• Kicksecure: No special notice.
• Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template Modification .

5 Done.

The procedure of installing package(s) user-sysmaint-split sysmaint-panel is complete.

Usage

The sysmaint desktop session.

The sysmaint console session.

After installing user-sysmaint-split, you will no longer be able to use sudo or pkexec when logged into any account other than sysmaint. Features of Kicksecure that require privilege escalation will also no longer work. This change takes effect immediately.

To perform system maintenance tasks such as checking for software updates, installing updates, etc, you will have to reboot into the sysmaint account. To do this, restart the system normally, then select PERSISTENT mode SYSMAINT (For system maintenance.) from the boot menu. The system will boot into a minimal desktop session with the System Maintenance Panel app running. To reduce attack surface, most superfluous background services are suppressed while booted into the sysmaint account.

The sysmaint desktop session is intentionally minimal and not suited for normal desktop use. This is to discourage using it for work that has a higher risk of causing a difficult-to-avoid system compromise (such as web browsing). Quick shortcuts are provided for simple software management and system administration tasks, while more advanced tasks can be performed from a terminal. The sudo and pkexec commands will be usable here.

Once you are done with system maintenance tasks, click "Reboot" to reboot the system. Then boot into PERSISTENT mode USER (For daily activities.) or LIVE mode USER (For daily activities.). This will provide you with a standard desktop session.

You can also log into the sysmaint account from a virtual consoles (tty). Simply input the account name sysmaint at the login prompt. This session behaves identically to a typical virtual console session. A short informational message will be printed after login reminding you that the sysmaint account must be used with caution.

Notes

• Several restrictions are imposed to reduce the risk of the sysmaint account becoming compromised:
  • The sysmaint account is locked and cannot be logged into when booted into modes other than PERSISTENT mode SYSMAINT.
  • Logging into the sysmaint using anything other than the special sysmaint session is prohibited.
  • When booted in PERSISTENT mode SYSMAINT, you will be discouraged (but not entirely prevented) from logging into accounts other than sysmaint. We don't lock accounts other accounts on the system, since doing so would make it very tricky or even impossible for the user to permanently lock accounts themselves.

Questions and Answers

• Why is there a separate sysmaint account?
  • See Rationale for Separate sysmaint Account.

• Why is it required to boot into sysmaint mode, why not simply use start menu -> switch user?
  • This is to mitigate login spoofing attacks and to to prevent sudo password sniffing.

• How to go back to classic sudo mode, where user user can use sudo?
  • See #Uninstallation.

Uninstallation

This chapter documents how to disable user-sysmaint-split and to go back to classic sudo mode, where user user can use sudo.

Optional. Discouraged.

If user-sysmaint-split comes installed by default, the easiest to remove it is by using dummy-dependency to avoid meta package removal issues (Debian Packages).

dummy-dependency --purge user-sysmaint-split

Optional. Removal of sysmaint-panel is optional because it is a graphical user interface (GUI) that can also be used with classic sudo setup.

dummy-dependency --purge sysmaint-panel

Developers

• User Account Isolation (developers)
• user-sysmaint-split (developers)
• https://github.com/Kicksecure/user-sysmaint-split
• https://github.com/Kicksecure/sysmaint-panel

the best case potentially realistic scenario for fast user switching from `user` to `sysmaint` - in theory - would be

1. logout with "save session" as user `user`. as in saving the session to disk and allow it to be resumed. but no processes must continue to run.

2. SysRq + SAK

3. login into sysmaint

4. logout sysmaint

5. SysRq + SAK (optional, just to establish the habbit)

6. resume user `user` session

Footnotes

Kicksecure A secure by default operating system with the latest security research in place.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Kicksecure is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Kicksecure we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2024 ENCRYPTED SUPPORT LP

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!