Field Notes

entity

Kicksecure

StatusStableReviewdue UpdatedStands on3 sourcesSupportsnotes

Kicksecure is a security-hardened Linux distribution based on Debian. It applies dozens of security-hardening defaults that upstream Debian does not ship, implementing recommendations from the Securing Debian Manual supplemented with original research. The project was created by the founder of Whonix in 2018, with the first stable ISO released in 2024. Kicksecure 18 is based on Debian 13 (Trixie).

Security model

Kicksecure pursues defense-in-depth within a traditional Debian package-management model:

  • Account isolation: user-sysmaint-split enforces separate daily and administrative accounts. The daily user cannot access sudo, su, or pkexec; only the sysmaint account can escalate privileges.
  • SUID reduction: SUID Disabler and Permission Hardener removes unnecessary SUID binaries and tightens file permissions.
  • Kernel hardening: extensive sysctl settings and boot arguments aligned with KSPP, strict CPU vulnerability mitigations, kernel module blacklisting, and optional post-boot module loading restriction.
  • Network security: all APT updates routed through Tor, tirdad for TCP ISN randomization, sdwdate for secure time synchronization (replacing unauthenticated NTP), no open server ports by default, Bluetooth disabled by default, hardened SSH client and server configuration.
  • Data protection: full disk encryption enabled by default in the ISO installer, ram-wipe at shutdown, coredump and PStore disabled, strong entropy generation.
  • Physical security: emergency shutdown via panic key, recovery mode lockdown, deep scan readiness for external inspection.
  • Supply chain: digital signature verification at all development stages, warrant canary.

Relationship to Whonix

Whonix is built on top of Kicksecure. Kicksecure provides the security-hardened base; Whonix adds Tor routing and anonymity features. Users who need security without anonymity use Kicksecure; users who need anonymity use Whonix. Both share the same development team and tooling.

Deployment options

Kicksecure is available as:

  • An ISO for bare-metal installation (Calamares graphical installer with FDE by default).
  • VM images for VirtualBox, KVM, and Qubes OS.
  • A live mode with anti-forensic properties (all data wiped after session).

The live mode provides protection against forensic analysis, and is the feature that brings Kicksecure closest to Tails. The two arrive at amnesia from opposite directions: Kicksecure is a persistent system that can be booted without writing to disk, while Tails is an amnesic system that can be given a persistent volume. The default is the difference that matters, because it decides what happens when a user forgets to make a choice.

Desktop environment

Kicksecure 18 uses LXQt with Wayland. Previous versions used Xfce. GNOME and KDE are not used due to security and performance concerns in VM contexts.

Limitations

Debian’s slower package update cadence compared to Fedora can leave applications running older library versions. Kicksecure does not provide VM-level isolation on its own; it relies on being run inside a hypervisor (VirtualBox, KVM, Qubes) for compartmentalization. The project is maintained by a small team and depends on community testing for releases.

See also

Built on 3 sources (3 external).

Working out connections…